Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires the implementation of NIST SP 800-171 security controls to protect Controlled Unclassified Information (CUI) on systems operated by the subcontractor, in full alignment with the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. This includes establishing and maintaining a robust cybersecurity framework that safeguards CUI from unauthorized access, disclosure, or compromise, while ensuring all systems are configured, monitored, and audited to meet the specified NIST standards. The contractor must also establish and document processes for promptly detecting, reporting, and responding to cyber incidents involving CUI, as mandated by DFARS, including timely submission of incident reports to the Department of Defense. The contract is a subcontract under the Department of Defense, specifically tied to the Maritime Supply Chain ESOc Buys office, with performance required at Cherry Point, North Carolina, zip code 28533-0021. The NAICS code 541512 indicates the work involves computer systems design and related services, aligning with the technical nature of cybersecurity implementation. Proposals must be submitted by August 3, 2026, and the solicitation is open to qualified entities capable of demonstrating prior experience in securing CUI environments under federal cybersecurity regulations. The subcontractor is expected to possess the technical capability, documentation practices, and incident response infrastructure necessary to meet all compliance obligations without relying on external government support.