Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls across all systems that handle Controlled Unclassified Information, ensuring alignment with federal cybersecurity standards for safeguarding sensitive but unclassified data. Annual assessments must be conducted to verify compliance with these controls, and any cyber incidents affecting CUI must be reported promptly in accordance with DFARS requirements. The work is classified as a subcontract under NAICS code 541512 and is managed by the Active Devices Division of the Department of Defense, with performance obligations centered at Tracy, California, 95304-5000. The solicitation was posted on July 30, 2026, and responses are due by August 10, 2026.