Cybersecurity Compliance and CUI Safeguarding

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 Rev 2 cybersecurity controls to safeguard Controlled Unclassified Information throughout all phases of manufacturing, testing, and data submission. Compliance must be enforced across the entire work scope, with specific attention to secure handling, access restrictions, and data integrity measures as defined by the framework. Any cybersecurity incidents involving CUI must be reported promptly in accordance with federal requirements, and the obligations must be flowed down to all subcontractors to ensure consistent protection across the supply chain. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, classified under NAICS code 541512 for computer systems design services, and is solicited by the Department of Defense through the LAND SUPPLY CHAIN office. Performance is required at a facility located in Tracy, California, with a response deadline of July 22, 2026. The contractor must be prepared to demonstrate continuous compliance and maintain documentation to verify adherence to all NIST controls, with no exceptions allowed for any part of the CUI lifecycle.