Cybersecurity Compliance (NIST SP 800-171)

The contract requires implementation and maintenance of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information across organizational systems. This includes developing a System Security Plan that documents the implemented safeguards, managing a Plan of Action and Milestones to address identified security gaps, and establishing procedures for timely incident reporting in compliance with federal requirements. The work is scoped as a subcontract under the Department of Defense’s Strategic Acquisition Program Directorate and falls under NAICS code 541512 for computer systems design services. All activities must be completed in accordance with federal standards and are subject to oversight to ensure continuous compliance and risk mitigation. The solicitation was posted on July 23, 2026, with a response deadline of August 7, 2026, indicating a short turnaround for proposers to demonstrate technical capability and experience in NIST 800-171 compliance. Performance is expected to support DoD information systems but the exact location of performance is not specified. The subcontractor must possess the expertise to interpret and apply NIST controls in real-world environments, maintain accurate documentation, and respond to security incidents in alignment with federal incident reporting protocols. There is no set-aside designation, meaning all eligible entities may submit proposals without restriction based on business size or category.