Cybersecurity Compliance for Controlled Technical Information (NIST SP 800-171)

This contract requires the implementation and maintenance of NIST SP 800-171 compliance for systems that handle Controlled Unclassified Information, specifically related to controlled technical information. The work is scoped to ensure all security controls outlined in NIST SP 800-171 are properly deployed, monitored, and sustained to protect CUI within the contractor’s information systems. The requirement is part of a subcontract under a Total Small Business Set-Aside, meaning only small businesses are eligible to respond, and it is classified under NAICS code 541512 for computer systems design services. Performance of the contract will be centered in New Cumberland, Pennsylvania, with the primary obligation focused on cybersecurity readiness and ongoing adherence to federal protection standards for sensitive but unclassified data. The solicitation is issued by the Department of Defense through the Land Supply Chain organization, and responses must be submitted by July 27, 2026, with the posting date of July 16, 2026. The subcontractor must demonstrate the capability to meet all NIST 800-171 baseline requirements and sustain compliance throughout the contract period, including documentation, system auditing, incident response readiness, and continuous monitoring. Failure to maintain compliance could result in termination, penalties, or loss of access to CUI, making rigorous adherence to the framework a critical and non-negotiable component of this engagement.