Cybersecurity Compliance for CUI (NIST SP 800-171)

The contract requires the implementation and maintenance of cybersecurity controls for contractor systems that process, store, or transmit Controlled Unclassified Information, in full alignment with the requirements of NIST Special Publication 800-171. This includes establishing comprehensive documentation of security policies and procedures, maintaining detailed audit logs to track access and system activity, and ensuring timely and accurate reporting of any cybersecurity incidents. All activities must be performed to meet federal standards for protecting CUI, with an emphasis on consistent compliance, continuous monitoring, and readiness for assessment or audit. The systems involved must be secured against unauthorized access, data exfiltration, and other cyber threats through defined technical, administrative, and physical safeguards. The contract is structured as a small business set-aside under the SBA’s Total Small Business Set-Aside authority, restricted exclusively to qualified small businesses as defined by the North American Industry Classification System code 541512, which pertains to computer systems design and related services. It is issued by the Department of Defense through its DCSCO Richmond Division #1, with performance required at a designated location in Richmond, Virginia, zip code 23237. The solicitation was posted on April 27, 2026, and responses are due by May 27, 2026, at 3:59 AM EDT. Contractors must be prepared to demonstrate full compliance with NIST 800-171 controls, provide evidence of implementation, and sustain accountability for security posture throughout the life of the subcontract.