Cybersecurity Compliance for Controlled Unclassified Information (CUI)

This contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST Special Publication 800-171 to safeguard Controlled Unclassified Information within non-federal systems. The work is scoped to ensure compliance with federal standards for protecting sensitive data handled by contractors supporting the Department of Defense, specifically under the Medical Supply Chain MD Surg FSF. The subcontractor must establish, document, and sustain technical and administrative safeguards that meet the full suite of 110 controls outlined in NIST SP 800-171, including access control, audit and accountability, configuration management, and incident response, among others, to secure CUI across all affected networks, systems, and devices. The contract is designated as a subcontract under NAICS code 541512, indicating it involves computer systems design and related services, with performance expected to occur at the FPO address with ZIP code 96672. Responses must be submitted by May 18, 2026, following the posting date of May 11, 2026. The effort is mission-critical to the Department of Defense’s requirements for supply chain security, and failure to fully implement and maintain the required controls could result in non-compliance, loss of contract eligibility, or exposure of sensitive data. Continuous monitoring, documentation of compliance, and readiness for audits are implicit expectations, with the contractor responsible for maintaining ongoing adherence throughout the contract period.