Cybersecurity Compliance and NIST SP 800-171 Implementation

The contract requires the implementation and documentation of compliance with NIST Special Publication 800-171 Rev 1 for all systems handling Controlled Unclassified Information, ensuring that security controls are properly integrated, tested, and maintained. This includes the development and ongoing management of a Plan of Actions and Milestones to address any identified gaps in compliance, as well as accurate reporting through the Supplier Performance Risk System to demonstrate adherence to federal cybersecurity standards. All activities must align with the requirements for safeguarding CUI in nonfederal systems and must be thoroughly documented to support audit readiness and continuous monitoring. The work is performed under a subcontract issued by the ASC Commodities Division of the Department of Defense, with the primary place of performance located in Suffolk, Virginia, at ZIP code 23435-5000. The solicitation was posted on May 10, 2026, and responses are due by May 18, 2026. The North American Industry Classification System code 541612 identifies this as an information technology and cybersecurity services engagement. The contract mandates strict adherence to DoD cybersecurity frameworks, with an emphasis on operational transparency, timely reporting, and technical validation of implemented controls to protect sensitive but unclassified data.