Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and maintenance of NIST Special Publication 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within Department of Defense contract environments. All work must align with federal cybersecurity standards to ensure the confidentiality, integrity, and availability of sensitive information handled under DOD agreements. This is a subcontract opportunity set aside exclusively for small businesses under the SBA’s Total Small Business Set-Aside program, with the NAICS code 541512 indicating it pertains to computer systems design and related services. The solicitation is open with a response deadline of August 7, 2026, and performance will occur in locations determined by the awardee’s operational footprint under the Strategic Acquisition Program Directorate. Compliance with NIST SP 800-171 is mandatory, encompassing a range of administrative, technical, and physical controls designed to mitigate cyber threats to CUI. The awardee must demonstrate proven capability in executing and sustaining these controls across all systems and networks handling CUI, with ongoing monitoring, documentation, and reporting obligations. As a DOD subcontract, adherence to federal acquisition regulations and cybersecurity requirements is non-negotiable, and the contractor will be expected to maintain continuous compliance through assessments, audits, and remediation activities. All activities must support the broader mission of protecting sensitive defense-related information while operating within the constraints and expectations of a small business set-aside contract.