Cybersecurity and CUI Protection (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of a comprehensive cybersecurity program aligned with NIST SP 800-171 Rev 1 standards, specifically designed to protect Controlled Unclassified Information. A core deliverable is the development of a fully documented System Security Plan that outlines policies, procedures, and controls to ensure compliance across all applicable security requirements. The contractor must also achieve and maintain the necessary assessment scores to validate adherence to the NIST framework, demonstrating that all required safeguarding measures are effectively in place and operational. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, with the NAICS code 541512 indicating it pertains to computer systems design services. The solicitation, issued by the Department of Defense through the ASC SUPPLIER OPER AE AND AF DIV, is open for responses until August 24, 2026, with performance expected to occur at an unlisted location. The successful vendor must demonstrate expertise in federal cybersecurity compliance, particularly in managing CUI within DoD contractor environments, and be prepared to support continuous monitoring, documentation, and assessment activities required to sustain certification under NIST SP 800-171 Rev 1.