Cybersecurity Compliance (NIST SP 800-171) for Suppliers

This contract requires the implementation and documentation of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information as part of a defense subcontract. The work is focused on ensuring that all applicable security requirements are properly established, maintained, and verified to meet federal standards for protecting sensitive data within the supply chain. The successful offeror must demonstrate a thorough understanding of the NIST framework and be capable of fully documenting compliance across all 110 control families, with particular attention to access control, audit, configuration management, incident response, and system and communications protection. Performance of this contract is located in San Diego, California, with a submission deadline of August 13, 2026, and the solicitation was posted on August 5, 2026. The North American Industry Classification System code is 541512, indicating the work involves computer systems design and related services. This is a subcontract under the Department of Defense, specifically managed by the ASC Commodities Division, and the entity must be prepared to support ongoing compliance activities, potential audits, and continuous monitoring of security controls. All deliverables must align strictly with NIST SP 800-171 requirements to ensure the contractor’s systems and processes meet the stringent cybersecurity standards mandated for defense contractors handling Controlled Unclassified Information.