Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires the implementation and thorough documentation of all NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within the contractor’s systems and environments. The primary objective is to ensure full compliance with the cybersecurity requirements established by the Department of Defense, specifically to support an official assessment under clause 252.240-7997, which mandates the capability to demonstrate adherence to CUI protection standards. All systems handling CUI must be configured, monitored, and audited according to the 110 controls outlined in NIST SP 800-171, including access control, audit and accountability, configuration management, identifier management, incident response, and maintenance, among others. Documentation must be precise, up-to-date, and capable of withstanding rigorous third-party evaluation. The work is classified as a subcontract under NAICS code 541512, indicating it falls under the category of computer systems design and related services. Performance is designated for the New Cumberland facility with a ZIP code of 17070-5002, and the contracting activity is managed by the Department of Defense through the DDSP New Cumberland Facility. Proposals must be submitted by August 10, 2026, with the solicitation posted on July 30, 2026. While no set-aside type is specified, potential offerors must be prepared to meet the full scope of CUI protection and assessment readiness without deviation. The contract expects ongoing operational compliance, not just initial implementation, requiring continuous monitoring, documentation updates, and readiness for periodic DoD assessments.