Cybersecurity & CUI Safeguarding Compliance

The contract requires implementation of NIST SP 800-171 security controls to protect Controlled Unclassified Information within contractor systems, along with the development of a comprehensive System Security Plan that documents policies, procedures, and technical measures for safeguarding CUI. Full compliance with CMMC Level 2 standards is mandatory, ensuring that cybersecurity practices meet the Department of Defense’s framework for managing cyber risk across the supply chain. The work involves assessing existing systems, identifying gaps in current controls, and implementing necessary technical and administrative safeguards to achieve and maintain compliance. This is a subcontract under a Total Small Business Set-Aside, designated for small businesses as defined by the SBA, with the NAICS code 541512 covering computer systems design and related services. The place of performance is Tinker Air Force Base, Oklahoma, with a response deadline of August 7, 2026, and the solicitation posted on July 27, 2026. The contract is issued by the Active Devices Division under the Department of Defense, requiring all work to align with federal cybersecurity mandates and be performed in accordance with stringent defense contracting requirements.