Cybersecurity Compliance for CUI (NIST SP 800-171)

The contractor must ensure all information systems handling Controlled Unclassified Information (CUI) fully comply with the security requirements outlined in NIST Special Publication 800-171. This includes implementing all applicable controls to protect the confidentiality, integrity, and availability of CUI, conducting a comprehensive self-assessment of cybersecurity posture, and maintaining accurate documentation to demonstrate adherence. The requirement applies across all systems and environments used to perform contract-related work, and compliance is mandatory for continued performance under the agreement. This subcontract falls under the North American Industry Classification System code 541512 and is managed by the Defense Logistics Agency within the Department of Defense. The contract does not specify a geographic location for performance, and no set-aside provisions are indicated. The contractor is expected to maintain ongoing compliance, with self-assessment results and supporting documentation subject to review at any time. Noncompliance may result in contract termination, financial penalties, or loss of eligibility for future work involving CUI.