Cybersecurity Compliance for CUI Handling

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect Controlled Unclassified Information (CUI) within the systems and processes of the subcontractor. This includes establishing technical, administrative, and physical safeguards to ensure the confidentiality, integrity, and availability of CUI, as well as maintaining comprehensive compliance documentation to demonstrate adherence to federal cybersecurity standards. The subcontractor must also establish and execute a cyber incident reporting protocol to promptly notify the appropriate authorities of any security breaches or anomalies affecting CUI, ensuring timely response and mitigation. This subcontract falls under the NAICS code 541512 for computer systems design services and is issued by the Defense Logistics Agency under the Department of Defense. It is classified as a subcontract with no specific set-aside designation and does not specify a geographic place of performance. The contract is tied to the DLA’s broader mission to secure sensitive information across its supply chain and is accessible through the DIBBS platform with the contract number SPE4A626PS064. Ongoing compliance is critical, requiring continuous monitoring, audits, and updates to security controls to remain aligned with evolving NIST requirements and DoD expectations.