Cybersecurity Compliance and CUI Protection

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information across all systems and processes under the scope of work. This includes the development and documentation of a System Security Plan that accurately reflects the organization’s controls, risk mitigation strategies, and compliance posture. All activities must align with federal requirements for protecting CUI, ensuring that access, transmission, storage, and handling practices meet the mandatory standards outlined in the NIST framework. Continuous monitoring and assessment of security controls are expected to maintain compliance and address emerging threats. The subcontractor must also establish and execute a cyber incident reporting protocol in accordance with applicable federal directives, ensuring timely detection, containment, and notification of any security breaches or anomalies involving CUI. Performance is tied to the designated place of performance in Perry Point, Maryland, with all work intended to support the Department of Defense’s Medical Supply Chain mission. The solicitation closes on May 5, 2026, and is classified as a subcontract under NAICS code 541512, indicating a focus on computer systems design services related to cybersecurity compliance and infrastructure protection.