Cybersecurity and CUI Safeguarding (NIST SP 800-171 Compliance)

The contract mandates the implementation and assessment of cybersecurity controls specifically designed to protect Controlled Unclassified Information (CUI) in accordance with NIST Special Publication 800-171 requirements. Work is to be performed at the designated place of performance in Oak Harbor, Washington, with a focus on securing systems and environments that handle sensitive but unclassified data. All contractors must demonstrate full compliance with the 110 security controls outlined in NIST SP 800-171, including robust access control, incident response, audit logging, and data encryption measures, and must successfully undergo a formal assessment to validate compliance prior to contract execution. The effort supports the Department of Defense’s broader objective of securing the maritime supply chain by ensuring that subcontractors maintain a rigorous security posture consistent with federal standards. This is a subcontract opportunity issued under NAICS code 541512 for Computer Systems Design and Related Services, with a response deadline of June 11, 2026. The contracting activity originates from the Maritime Supply Chain ESOC Buys office within the Department of Defense, indicating the requirement is tied to critical defense logistics infrastructure. Contractors must be prepared to provide detailed documentation of policies, procedures, and technical implementations supporting each control, and may be subject to ongoing monitoring or periodic reassessment throughout the contract term. While no set-aside designation is specified, all proposers must be capable of meeting stringent federal security requirements and demonstrate proven experience in CUI protection and NIST 800-171 compliance engagements.