Cybersecurity and CUI Safeguarding (NIST SP 800-171)

The contract requires implementation of all NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information across systems and environments operated by the contractor. This includes documenting, configuring, and enforcing technical and administrative protections that align with the NIST framework to ensure compliance with federal standards for handling CUI. In addition to control implementation, the contractor must conduct a thorough CMMC Level 2 self-assessment, evaluating readiness against the required practices and processes, and prepare supporting documentation to demonstrate compliance without third-party validation. The work is scoped as a subcontract under the Department of Defense's Active Devices Division, with performance expected to occur in Columbus, Ohio, 43213. The solicitation was posted on July 20, 2026, with a response deadline of July 31, 2026, and falls under NAICS code 541512 for computer systems design services. The contractor must possess the technical expertise to interpret and apply NIST guidelines accurately, maintain audit trails for all implemented controls, and ensure that all system configurations, policies, and procedures are aligned with both NIST SP 800-171 requirements and CMMC Level 2 objectives. No set-aside provisions are indicated, and the contract is not subject to specific small business or other socioeconomic constraints.