Cybersecurity Compliance and CUI Handling (NIST SP 800-171)

The contractor is required to fully comply with NIST Special Publication 800-171 to safeguard Controlled Unclassified Information (CUI) across all systems used in support of the contract. This includes implementing the full suite of security requirements outlined in the publication, maintaining documented evidence of compliance, and conducting regular assessments to verify that controls are properly configured and operational. The contractor must ensure that all processes related to CUI handling, storage, transmission, and access are aligned with federal standards and are subject to verification through audits or evaluations. The contract is a subcontract under the Defense Logistics Agency, part of the Department of Defense, and is classified under NAICS code 541512 for computer systems design services. The performance location and specific agency office details are not specified, but compliance obligations apply regardless of physical location. The contractor must maintain continuous readiness to demonstrate adherence to NIST SP 800-171 requirements, as failure to meet these standards could result in contract non-compliance, suspension of work, or termination. Documentation of policies, procedures, system configurations, and assessment outcomes must be readily available for review by government representatives at any time.