Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires the implementation of all NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within the contractor’s systems and environments. This includes the comprehensive development of a System Security Plan that documents how each control is addressed, ensuring alignment with federal cybersecurity standards. All required cybersecurity documentation must be prepared, verified, and submitted as part of the compliance obligation, with the goal of achieving and maintaining CUI protection integrity throughout the system lifecycle. The work is scoped to support the Department of Defense’s Medical Supply Chain program and must be performed at the designated location in Virginia Beach, Virginia, with a zip code of 23459-3018. The contract is classified as a subcontract under NAICS code 541512, which pertains to custom computer programming services, and is issued under the Medical Supply Chain MD SURG FSF. The solicitation was posted on April 29, 2026, with a firm deadline for responses on May 5, 2026. All submissions must adhere to the technical and compliance requirements outlined in NIST SP 800-171, and failure to meet these standards will result in non-compliance. The performance location is fixed, and while no point of contact is listed, all communications and deliverables must follow the official procurement channel via the DIBBS platform. The effort is critical to enabling secure handling of sensitive government information within the defense medical logistics ecosystem.