Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires implementation of NIST SP 800-171 safeguards to ensure the protection of Controlled Unclassified Information on non-federal systems, aligning with DFARS cybersecurity requirements. This subcontract is focused on establishing and maintaining a robust cybersecurity framework to meet federal standards for handling CUI, specifically within systems managed by or on behalf of the Department of Defense. The contractor must demonstrate the ability to apply the full set of 110 security controls outlined in NIST SP 800-171, including access control, identification and authentication, audit and accountability, system and communications protection, and incident response, to ensure continuous compliance. Performance is expected to occur at Hill Air Force Base, Utah, with a response deadline of August 3, 2026, and the solicitation is posted under NAICS code 541512 for computer systems design services. The work does not involve a specific set-aside type and is being procured as a subcontract through the Defense Logistics Agency’s DIBBS platform. Failure to implement and document all required controls will result in non-compliance with federal regulations, potentially jeopardizing contract eligibility and future DoD opportunities. The contractor must be prepared to undergo assessment and validation of their cybersecurity posture to verify adherence to the NIST framework throughout the contract lifecycle.