Cybersecurity Compliance for CUI Handling

The contract requires strict adherence to NIST SP 800-171 standards for all systems that process, store, or transmit Controlled Unclassified Information, ensuring robust cybersecurity controls are implemented and maintained. Key deliverables include the development and maintenance of a comprehensive System Security Plan tailored to the organization’s infrastructure, along with active management of the CAGE code to maintain accurate federal identification and eligibility. All cyber incidents affecting CUI must be reported through the Defense Industrial Base Cyber Incident Reporting portal within a strict 72-hour window to ensure timely response and compliance with federal reporting mandates. This is a subcontract under the Department of Defense, categorized under NAICS code 541512 for computer systems design services, with a response deadline of May 8, 2026. The procurement is managed by the Maritime Supply Chain ESOC Buys office and requires full alignment with DOD cybersecurity expectations, including documentation rigor, continuous monitoring, and immediate incident escalation. Failure to meet any component of these requirements could result in non-compliance, contract termination, or loss of eligibility for future DOD work.