Cybersecurity & NIST SP 800-171 Compliance Assessment

The contract requires implementation and assessment of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within the contractor’s systems, ensuring alignment with Department of Defense cybersecurity requirements. This includes conducting a comprehensive self-assessment of all 110 security controls outlined in NIST SP 800-171, maintaining detailed documentation to demonstrate compliance, and establishing procedures for timely cyber incident reporting in accordance with DFARS 252.204-7012. The work must be performed at the specified place of performance in Tracy, California, with all deliverables due by the response deadline of July 20, 2026. The subcontract falls under NAICS code 541512 for computer systems design services and is issued by the Active Devices Division within the Department of Defense. Compliance is mandatory and will be evaluated based on the contractor’s ability to fully implement and validate the required security controls, produce an accurate System Security Plan, and maintain records that support continuous monitoring and incident response capabilities. Failure to meet these requirements could result in non-compliance penalties and loss of contract eligibility for future DoD procurements.