Cybersecurity Compliance for Contractor Systems (NIST SP 800-171)

The contract requires the implementation and assessment of NIST Special Publication 800-171 security controls on contractor systems that process, store, or transmit Controlled Unclassified Information in accordance with Defense Federal Acquisition Regulation Supplement requirements. This subcontract mandates full compliance with the 110 security controls outlined in NIST SP 800-171, including those related to access control, audit and accountability, configuration management, identification and authentication, maintenance, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. Contractors must conduct a thorough assessment of their information systems to demonstrate alignment with these controls and provide documented evidence of implementation to satisfy DOD compliance expectations. The submission deadline for responses is August 10, 2026, with the solicitation posted on July 30, 2026 under the NAICS code 541512 for Computer Systems Design Services. The contracting entity is the Maritime Supply Chain division of the Department of Defense, and performance is expected to occur wherever the contractor’s systems supporting CUI are located. Compliance with this contract is critical for maintaining eligibility to handle sensitive defense information and for ensuring alignment with federal cybersecurity standards governing contractors in the defense industrial base. Failure to meet these requirements may result in contract termination or exclusion from future DOD opportunities.