Cybersecurity Compliance for Subcontractors (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) on systems used by subcontractors supporting Department of Defense operations. Compliance with these controls is mandatory and encompasses a broad range of cybersecurity requirements including access control, risk assessment, audit and accountability, configuration management, and incident response. The work is to be performed at the specified location in Tracy, California, with a zip code of 95304-5000, and the performance is tied to systems handling sensitive defense-related data, ensuring the information remains secure and resilient against cyber threats. Contractors must respond to this subcontract opportunity under NAICS code 541512, which pertains to custom computer programming services, and are expected to meet all technical, procedural, and documentation requirements necessary to achieve and sustain NIST 800-171 compliance. The solicitation was posted on July 22, 2026, and proposals must be submitted by August 3, 2026, with no set-aside designation specified. The contract is managed by the DLA Dist San Joaquin under the broader Department of Defense, and adherence to the security framework is critical for continued eligibility to support defense-related projects involving CDI.