Cybersecurity & Covered Contractor Information Systems (NIST SP 800-171)

This contract requires the implementation and assessment of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information within contractor information systems, ensuring compliance with federal cybersecurity standards for handling sensitive but unclassified data. The scope focuses on securing covered contractor information systems against unauthorized access, disclosure, and compromise, with a requirement to document and validate the effectiveness of the implemented controls through formal assessment procedures. Participation is restricted to small businesses under a Total Small Business Set-Aside, as defined by the Small Business Administration, and the North American Industry Classification System code 541512 applies, indicating the work centers on computer systems design services. The contract is issued by the ASC Commodities Division within the Department of Defense, with performance expected to take place in Tracy, California, at the specified ZIP code. Proposals must be submitted by the deadline of August 7, 2026, following a posting date of July 30, 2026, and the opportunity is structured as a subcontract under a larger procurement framework. Compliance with all NIST SP 800-171 requirements is mandatory, and contractors must be prepared to demonstrate their security posture through assessments, potentially including self-assessments or third-party evaluations, to maintain eligibility and fulfill contractual obligations related to CUI protection.