Cybersecurity & CUI Safeguarding (NIST SP 800-171 Compliance)

The contract requires implementation and maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within the scope of Department of Defense operations. Compliance with these controls is mandatory to ensure the confidentiality, integrity, and availability of CUI, with specific emphasis on meeting the cybersecurity requirements outlined in DFARS for cyber incident reporting. The contractor must establish and sustain a secure environment that aligns with NIST guidelines, including access controls, audit and accountability measures, configuration management, and incident response protocols, all tailored to protect information processed, stored, or transmitted on contractor systems. Performance is expected to occur at the designated location in New Cumberland, Pennsylvania, with a submission deadline of August 3, 2026, and the solicitation was posted on July 21, 2026. This is a subcontract under NAICS code 541511 for computer systems design services, and while no set-aside classification is specified, it is issued under the Land Supply Chain organization within the Department of Defense. Full compliance with all cybersecurity obligations is critical to avoid contract penalties and maintain eligibility for future DoD work, as failure to report cyber incidents or implement required controls may result in noncompliance findings and potential termination.