Cybersecurity Compliance for Controlled Technical Data (NIST SP 800-171)

The contract requires the implementation and assessment of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within systems handling controlled technical data, with a focus on achieving full compliance with DFARS 252.204-7012. This includes conducting a thorough evaluation of existing cybersecurity practices, applying the required controls to meet NIST standards, and submitting a valid Supplier Performance Risk System (SPRS) score to document compliance status. The work must be performed at the designated location in Jacksonville, Florida, with all deliverables aligned to the Department of Defense’s expectations for protecting sensitive unclassified information. The contract is structured as a subcontract under NAICS code 541611 and is issued by the ASC Supplier Operations OEM Division. Proposals must be submitted by May 19, 2026, and the work is governed by federal cybersecurity regulations applicable to defense contractors. No set-aside provisions are specified, and the performance location is fixed at the Jacksonville address with no flexibility in place of performance. Compliance is not optional, and failure to meet the NIST 800-171 requirements or submit a compliant SPRS score will result in non-conformance, potentially jeopardizing the subcontract relationship and eligibility for future opportunities.