Cybersecurity Compliance and CUI Protection (IT Support)

This contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 to safeguard Controlled Unclassified Information (CUI) across all systems and processes. The contractor is responsible for developing and periodically updating a System Security Plan (SSP) that documents how each control is applied, monitored, and enforced to meet federal requirements. Compliance with DFARS 252.204-7012 is mandatory, meaning the contractor must promptly report any cyber incidents affecting CUI to the Department of Defense, including providing detailed incident documentation and cooperating with investigations as needed. All activities must be performed in support of the Defense Logistics Agency under the Department of Defense, with performance tied to the secure handling of sensitive defense-related information. The work falls under NAICS code 541512, indicating it involves computer systems design and related services, specifically focused on cybersecurity compliance. As a subcontract, the contractor will operate under the primary contract SPE7M326P1358 and is expected to maintain continuous adherence to federal cybersecurity standards without deviation. There is no set-aside designation specified, and performance may occur across various locations as dictated by operational needs. The contractor must ensure all technical and administrative controls are continuously validated, documented, and reported, with accountability for both proactive protection and reactive incident response under the terms of the DFARS clause.