Cybersecurity Compliance & CUI Safeguarding

The contract requires the implementation and thorough documentation of NIST SP 800-171 security controls to protect Controlled Unclassified Information (CUI) within a Department of Defense environment, specifically tied to operations at Camp Pendleton. The successful bidder must ensure full compliance with the mandated cybersecurity framework, including the preparation and submission of a System Security Plan and the completion of a Security Assessment and Reporting System (SPRS) assessment to accurately report the organization’s compliance posture. All activities must be executed in alignment with federal requirements for safeguarding CUI, with documentation demonstrating control implementation, risk mitigation, and continual compliance readiness. This is a subcontract opportunity under NAICS code 541611, with a response deadline of May 18, 2026, and the performance location clearly identified as Camp Pendleton, CA, with a ZIP code of 92055-5627. The contract is administered by the Medical Supply Chain MD Surg FSF under the Department of Defense, and the winning party will be responsible for maintaining all necessary technical and administrative records to support audits and SPRS reporting. Compliance is non-negotiable, and failure to meet NIST SP 800-171 requirements or accurately report via SPRS will result in non-conformance and potential contract termination.