Cybersecurity Compliance for CUI Handling

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 compliance for all systems that handle Controlled Unclassified Information, specifically targeting order tracking, inventory, and invoicing operations. This includes ensuring that technical, administrative, and physical safeguards are fully aligned with the NIST framework to protect CUI from unauthorized access, disclosure, or compromise. The contractor must establish and document security controls, conduct regular assessments, and maintain audit trails to demonstrate continuous compliance throughout the performance period. This is a subcontract under the Department of Defense’s Medical Supply Chain MD Surg FSF, with performance centered at FPO, ZIP 09566-4008. The solicitation was posted on July 15, 2026, and responses are due by July 21, 2026. The NAICS code 541512 identifies the scope as computer systems design and related services, indicating the work involves technical implementation rather than general IT support. The requirement emphasizes operational readiness and sustained adherence to federal cybersecurity standards, with no set-aside provisions specified, making it open to eligible subcontractors regardless of business size or certification status.