Cybersecurity Compliance for Controlled Unclassified Information

The contract requires implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information and ensure full compliance with Department of Defense cyber incident reporting obligations. This subcontract is positioned under the NAICS code 541512 and is associated with the Medical Supply Chain Pharm FSA under the Department of Defense, with performance required at Fort Bragg, North Carolina, zip code 28310. Bidders must meet all cybersecurity requirements outlined in NIST SP 800-171, including but not limited to access control, audit, configuration management, identification and authentication, maintenance, media protection, personnel security, risk assessment, system and communications protection, and system and information integrity controls. Compliance with DFARS 252.204-7012 and timely reporting of any cyber incidents affecting CUI is mandatory, with no tolerance for noncompliance or delayed reporting. The solicitation was posted on July 19, 2026, and responses are due by July 27, 2026, with no set-aside classification indicated. The subcontract is for cybersecurity services specifically tailored to protect sensitive yet unclassified defense-related data, with performance expectations grounded in federal cybersecurity standards. All parties must demonstrate proven experience in implementing NIST 800-171 controls, maintaining documentation of control implementation, and establishing processes for continuous monitoring and incident response. The requirement emphasizes not just technical implementation but also organizational readiness to satisfy DoD’s cyber compliance framework as a condition of contract execution.