Cybersecurity Compliance (NIST SP 800-171)

The contract requires full compliance with NIST SP 800-171 standards for all systems that handle contract information, mandating the development and implementation of a comprehensive System Security Plan and a detailed Plan of Action and Milestones to address any security gaps. These measures are essential to ensure the protection of controlled unclassified information within systems supporting the contract, with strict adherence to federal cybersecurity requirements. The work is positioned as a subcontract under the Department of Defense’s Aviation Supply Chain ESOC Buys, with performance occurring in Yuma, Arizona, and the NAICS code 541611 indicates the scope involves management, scientific, and technical consulting services focused on cybersecurity. The solicitation was posted on April 29, 2026, and responses are due by May 7, 2026, leaving a short window for qualified contractors to prepare and submit their proposals. No set-aside type is specified, meaning the opportunity is open to all eligible subcontractors without preference for small businesses or other categories. The place of performance is firmly established in Yuma, with a specific zip code assigned, indicating that physical or on-site activities may be required to support system compliance efforts. Contractors must ensure their cybersecurity infrastructure, documentation, and mitigation strategies meet NIST 800-171 requirements by the contract’s execution phase, with full accountability for maintaining and updating the System Security Plan and Plan of Action and Milestones throughout the agreement's lifecycle.