Cybersecurity Compliance and CUI Management

This contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect controlled unclassified information handled within systems supporting Department of Defense contracts. The successful offeror must achieve and sustain CMMC certification at the appropriate level, ensuring compliance with cybersecurity standards for handling sensitive government data. Ongoing responsibilities include accurate SPRS reporting to demonstrate compliance posture and the execution of a robust incident response plan to detect, respond to, and recover from cybersecurity events. All work must be performed under a Total Small Business Set-Aside, meaning only small businesses certified by the SBA are eligible to bid. The scope is aligned with NAICS code 541512, indicating the focus is on computer systems design and related services. Performance is expected to support Defense Department operations, with all compliance activities tied to safeguarding contract data throughout its lifecycle.