Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires the implementation and thorough documentation of all NIST SP 800-171 security controls to protect Covered Defense Information as mandated by DFARS 252.204-7012, ensuring compliance with federal cybersecurity standards for Controlled Unclassified Information. This subcontract is focused on establishing a robust security framework across systems and processes to meet the Department of Defense’s requirements for safeguarding sensitive data, with full accountability for control implementation, evidence gathering, and ongoing compliance validation. The performance location is specified as San Diego, CA, with the contract issued under NAICS code 541512 for computer systems design services. The opportunity is posted by the Active Devices Division of the Department of Defense, and responses must be submitted by August 3, 2026. The subcontract is open to qualified vendors capable of delivering end-to-end cybersecurity compliance support, including assessment, remediation, and continuous monitoring of CUI protections. There is no set-aside designation, and all eligible contractors may respond. Failure to fully implement and document the required NIST controls may result in non-compliance, contract termination, or loss of future DoD business opportunities.