Cybersecurity Compliance & CUI Protection (NIST SP 800-171)

The contract requires implementation and ongoing maintenance of NIST SP 800-171 security controls to protect controlled unclassified information handled by the contractor. This encompasses establishing proper technical, administrative, and physical safeguards as mandated by the standard, ensuring all systems and processes meet federal cybersecurity requirements for CUI. Regular self-assessments must be conducted to verify compliance, document findings, and address any gaps or vulnerabilities promptly. The contractor is also obligated to comply with all cyber incident reporting protocols, including timely detection, notification, and containment of security incidents involving CUI as defined by federal guidelines. This subcontract is issued under the Department of Defense, specifically by the Defense Logistics Agency, and falls under NAICS code 541512 for computer systems design services. The performance location and specific point of contact are not specified, but compliance obligations apply regardless of geographic scope. The contract is active as of July 16, 2026, and supports a broader DoD effort to enforce standardized cybersecurity practices across its supply chain. Failure to maintain adherence to NIST 800-171 controls or to report incidents as required could result in contractual penalties or loss of eligibility for future work involving CUI.