Cybersecurity Compliance and CUI Protection

The contract requires full implementation of NIST SP 800-171 controls to safeguard Covered Defense Information, ensuring all systems and processes meet stringent cybersecurity standards for protecting Controlled Unclassified Information. Entities must conduct regular self-assessments to validate compliance, submit findings through the Supplier Performance Risk System, and achieve and maintain CMMC Level 2 certification as a prerequisite for contract performance. Any cyber incidents affecting CDI must be reported to the appropriate government authorities within 72 hours of discovery, with documentation and remediation efforts aligned with federal requirements. Compliance is mandatory throughout the performance period, with continuous monitoring and documentation to demonstrate adherence to all applicable cybersecurity frameworks. The contract is structured as a subcontract under the Department of Defense through the Aviation Supply Chain office, with performance required at the Jacksonville location identified by zip code 32212-0103. The solicitation was posted on April 29, 2026, and responses are due by May 7, 2026. The NAICS code 541512 indicates the work involves computer systems design and related services, suggesting the subcontractor will provide cybersecurity implementation, assessment, and reporting capabilities. There is no set-aside designation, and the contract does not specify a point of contact, so all inquiries must follow standard DIBBS procedures via the provided UI link.