Cybersecurity & CUI Protection (NIST SP 800-171)

The contract requires the implementation and assessment of cybersecurity controls to safeguard Covered Defense Information in accordance with NIST SP 800-171 and DFARS requirements, ensuring compliance with federal standards for protecting sensitive government data. The work is scoped as a subcontract under the Department of Defense, specifically for the Medical Supply Chain MD Surg FSF, with performance to occur in San Diego, California, 92154. The solicitation, issued under NAICS code 541512 for Custom Computer Programming Services, mandates adherence to a rigorous cybersecurity framework that includes implementing control families such as access control, audit, configuration management, and incident response tailored to the handling of Controlled Unclassified Information. The response deadline is July 22, 2026, with the solicitation posted on July 16, 2026, indicating a tight six-day window for submissions. The contract is not subject to a specific set-aside classification, and the place of performance is fixed at the designated San Diego location, suggesting that the subcontractor must be capable of on-site operations or secure remote engagement with physical access to classified environments. Compliance with the full scope of NIST SP 800-171 is non-negotiable, and failure to meet assessment criteria may result in disqualification or contract breach. The subcontractor must be prepared to document, validate, and maintain continuous security posture alignment with DoD cybersecurity mandates throughout performance.