Cybersecurity Compliance & CUI Protection

The contract requires comprehensive cybersecurity support to ensure full compliance with DFARS 252.204-7012 and NIST SP 800-171 standards for all systems handling Contractual Controlled Unclassified Information. The successful vendor must implement and maintain robust security controls to protect CUI, including but not limited to access control, audit and accountability, configuration management, identification and authentication, and incident response capabilities. All activities must align with federal requirements for safeguarding sensitive but unclassified data across the contractor’s networks and information systems. This is a subcontract set aside exclusively for Service-Disabled Veteran-Owned Small Businesses, with the North American Industry Classification System code 541512 indicating the work falls under Computer Systems Design Services. The performance location is specified as Norfolk, Virginia, with a zip code of 23511. The solicitation was posted on July 7, 2026, and responses are due by 5:00 PM Eastern Time on July 14, 2026. The contracting activity is under the Department of Defense, specifically DLA Distribution, and the vendor must be prepared to demonstrate current compliance, ongoing monitoring, and documentation of security practices to satisfy federal audit and reporting obligations.