Cybersecurity and NIST SP 800-171 Assessment

The contract requires the implementation and assessment of cybersecurity controls to safeguard covered defense information in accordance with NIST Special Publication 800-171 and DFARS clause 252.240-7997, ensuring compliance with federal standards for protecting sensitive government data. This subcontract is designated as a total small business set-aside under the SBA program, limiting eligibility to small business concerns as defined by the North American Industry Classification System code 541512, which pertains to computer systems design and related services. The work is to be performed at the New Cumberland facility with a ZIP code of 17070-5002, and the performing organization must meet all technical and procedural requirements outlined in the referenced standards. The solicitation was posted on July 23, 2026, with a response deadline set for August 3, 2026, indicating a limited timeframe for submissions. The contracting activity is managed by the Department of Defense through the DDSP New Cumberland Facility, and while no specific point of contact is listed, interested parties must submit proposals via the DIBBS platform using the provided link. Compliance with NIST SP 800-171 controls is mandatory, covering areas such as access control, awareness and training, audit and accountability, configuration management, identification and authentication, maintenance, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. The assessment component involves verifying that all required controls are properly implemented and effectively operating to mitigate risks to covered defense information.