Cybersecurity and CUI Protection (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of cybersecurity controls outlined in NIST SP 800-171 to protect Controlled Unclassified Information (CUI) across all applicable systems and processes. This includes conducting comprehensive self-assessments to evaluate compliance with each control, documenting evidence of implementation, and ensuring all activities align with the Defense Federal Acquisition Regulation Supplement (DFARS) requirements. The scope demands a robust, continuous approach to maintaining cryptographic, access control, audit, and incident response measures, with a focus on sustaining compliance through regular reviews and updates. The work is designated as a subcontract under the NAICS code 541512, with the place of performance located in Tracy, California, and a response deadline of August 3, 2026. The contracting entity is the Department of Defense through the Land Supply Chain office, indicating this effort supports critical defense supply chain security objectives. Although no specific set-aside type is provided, the requirement is tied to a federal acquisition context where adherence to federal cybersecurity standards is mandatory and non-negotiable, with full accountability for documentation and assessment outcomes.