Cybersecurity Compliance and CUI Safeguarding (SSP & SPRS)

The contract requires the development and ongoing maintenance of a System Security Plan to ensure compliance with NIST SP 800-171 standards for protecting Controlled Unclassified Information. This includes implementing all required security controls, documenting policies and procedures, and establishing a robust framework for continuous monitoring and improvement of cybersecurity posture. The contractor must also register in the Supplier Performance Risk System to demonstrate compliance with DFARS clauses 252.204-7012 and 7020, which mandate safeguarding CUI and reporting cyber incidents. All activities must align with Department of Defense requirements and be performed in support of aviation supply chain operations. Performance is expected to be conducted at Jefferson City, Missouri, with a response deadline of May 21, 2026, and the solicitation issued under a subcontract structure tied to NAICS code 541611 for management consulting services. The effort centers on achieving and sustaining federal cybersecurity compliance, with no set-aside provisions specified, and requires consistent adherence to federal standards throughout the contract lifecycle. Failure to meet these requirements could jeopardize eligibility for future DoD contracts and expose the organization to significant regulatory and financial risk.