Cybersecurity Compliance and CUI Safeguarding

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) throughout all phases of performance. All subcontractors must be obligated to comply with the same cybersecurity requirements through flow-down clauses, ensuring end-to-end protection of CUI across the supply chain. Continuous monitoring for cyber incidents is mandatory, with any detected incident requiring reporting to the Department of Defense via DIBNET within 72 hours of discovery. The work will be performed at Cherry Point, North Carolina, and the contract is structured as a small business set-aside under the SBA’s Total Small Business Set-Aside program. The North American Industry Classification System code is 541512, and the contracting activity falls under the Department of Defense’s Land Supply Chain office.Responses are due by July 30, 2026, with the solicitation posted on July 23, 2026.