Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires implementation of NIST SP 800-171 security safeguards to protect Controlled Unclassified Information within contractor systems that process contract administration data for the Defense Logistics Agency. All subcontractors must ensure their information systems comply with the full set of NIST controls designed to secure CUI, including access control, audit and accountability, risk assessment, and system and communications protection measures. Compliance is mandatory and must be maintained throughout the contract lifecycle to safeguard sensitive government information handled in the course of contract administration. This subcontract falls under NAICS code 541512 for computer systems design services and is issued by the Department of Defense through the Defense Logistics Agency. The contract does not specify a set-aside status or geographic restriction, and performance is not tied to a particular location. The solicitation was posted in July 2026 and is accessible via the DIBBS system under contract number SPE8E826V1358. Contractors are responsible for demonstrating ongoing adherence to NIST SP 800-171 requirements, including documenting implementation, conducting assessments, and reporting any security incidents affecting CUI. Failure to comply may result in contract termination or penalties.