Cybersecurity Compliance (NIST SP 800-171) for Subcontractors

This contract focuses on ensuring that subcontractor systems meet the cybersecurity requirements outlined in NIST SP 800-171 Revision 2 to protect Controlled Unclassified Information (CUI) in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) mandates. It is a total small business set-aside under FAR 19.5, aimed at small businesses specializing in IT services classified under NAICS code 541512. The contract is issued by the Defense Logistics Agency Maritime - Puget Sound, part of the Department of Defense, with the place of performance specified in Bremerton, Washington. The primary objective is to enforce compliance with prescribed cybersecurity standards to safeguard sensitive but unclassified government data handled by subcontractors. This requirement highlights the importance of securing supply chain information systems to mitigate risks and ensure adherence to federal regulations. The contract was posted on May 14, 2026, and specifically targets subcontractors capable of implementing and maintaining NIST SP 800-171 guidelines. The contract's placement under a small business set-aside emphasizes the government's intent to support small enterprises in the defense contracting ecosystem.