Cybersecurity Compliance (NIST SP 800-171) Assessment and Reporting

The contract requires the implementation, assessment, and documentation of cybersecurity controls aligned with NIST SP 800-171 to protect Controlled Unclassified Information (CUI) on systems supporting Defense Federal Acquisition Regulation Supplement (DFARS) compliance. The work focuses on ensuring that all technical, administrative, and physical safeguards are properly deployed, evaluated for effectiveness, and thoroughly documented to meet federal cybersecurity standards for handling sensitive unclassified data. The performance location is specified as New Cumberland, PA, with a strict response deadline of July 6, 2026, and this is structured as a subcontract under the NAICS code 541512 for computer systems design services. This effort is directly tied to Department of Defense requirements as administered by the Maritime Supply Chain organization, emphasizing the need for precise adherence to NIST guidelines to mitigate risks associated with CUI exposure. All submitted documentation must demonstrate full compliance with the 110 security controls outlined in NIST SP 800-171, including continuous monitoring and remediation activities where gaps are identified. The subcontractor is expected to deliver a comprehensive assessment report detailing control implementation status, findings, and evidence of compliance, ensuring audit readiness for government evaluations. Failure to meet these requirements may result in noncompliance penalties and loss of contract eligibility.