Cybersecurity Compliance (NIST SP 800-171)

The contract requires implementation of all NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information (CUI) within systems and environments supporting the Department of Defense. Compliance must include a Self-Assessment Report using the Supplier Performance Risk System (SPRS), ensuring all required controls are documented, assessed, and reported accurately to demonstrate adherence to federal cybersecurity standards. The subcontractor must also establish and maintain robust procedures for timely cyber incident reporting in accordance with federal requirements, ensuring immediate notification and response to any breaches or suspicious activities involving CUI. The work is performance-based at Hill AFB, Utah, with a strict deadline for response on August 6, 2026, and falls under NAICS code 541512 for computer systems design services. As a subcontract, it is issued by the ASC Supplier Operations OEM Division under the broader DoD contracting framework, and full compliance with NIST controls is mandatory for contract execution and ongoing performance. All systems and processes must be aligned to support continuous monitoring, audit readiness, and secure handling of CUI throughout the contract lifecycle.