Cybersecurity Compliance for CUI (NIST SP 800-171)

The contract requires implementation of all NIST SP 800-171 cybersecurity controls on systems that handle Controlled Unclassified Information, ensuring compliance with federal requirements for protecting sensitive data. This includes establishing and documenting policies, procedures, and technical safeguards across the entire information environment to meet the standards expected for safeguarding CUI, with a strong emphasis on continuous monitoring, access control, audit logging, and incident response capabilities. The work is conducted under a subcontract relationship and is tied explicitly to preparing for a Department of Defense assessment under DFARS 252.240-7997, which necessitates full alignment with the security requirements outlined in the regulation and implicitly demands readiness for a Cybersecurity Maturity Model Certification Level 2 evaluation, even though formal CMMC certification is not explicitly required. All activities must be performed at the designated place of performance in New Cumberland, Pennsylvania, with the subcontractor expected to deliver a fully compliant, auditable cybersecurity posture by the response deadline of July 27, 2026. The effort is driven by the LSO Combat Vehicles and Armament office within the Department of Defense and falls under the NAICS code 541512 for computer systems design services. While no formal set-aside status is indicated, the work is clearly reserved for contractors capable of handling sensitive DoD contract data, requiring proven experience with NIST frameworks and the ability to demonstrate operational readiness for a formal DOD assessment without delay.