Cybersecurity Compliance and CUI Safeguarding (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of cybersecurity controls to safeguard contractor information systems in accordance with NIST SP 800-171 and DFARS 252.204-7012, ensuring that Controlled Unclassified Information is protected against unauthorized access, disclosure, or compromise. The contractor must conduct a self-assessment to achieve CMMC Level 2 compliance, validating adherence to the required security practices and processes outlined in the CMMC framework. This effort is critical to maintaining the integrity and confidentiality of information handled on behalf of the Department of Defense. The solicitation is structured as a small business set-aside under the SBA’s Total Small Business Set-Aside authority, limited to small business concerns as defined by NAICS code 541512, which covers custom computer programming services. Performance is to be conducted in Hampton, Virginia, with a response deadline of July 24, 2026, and the posting date indicates the opportunity was made available on July 16, 2026. The contracting activity falls under the ASC SUPPLIER OPER AE AND AF DIV of the Department of Defense, and the contract will be managed through the DIBBS platform. Compliance with these cybersecurity standards is mandatory and non-negotiable, as failure to adhere could result in contract termination or loss of eligibility for future DoD work.