Cybersecurity Compliance (NIST SP 800-171)

The contract requires implementation and maintenance of NIST SP 800-171 security controls to protect covered contractor information systems that handle controlled unclassified information. This effort is critical to ensuring the confidentiality, integrity, and availability of sensitive data within the Department of Defense’s supply chain. Compliance with all 110 controls outlined in NIST SP 800-171 is mandatory, covering areas such as access control, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. The subcontract is solicited under NAICS code 541512 for cybersecurity services and is tied to performance at Tracy, California, with a zip code of 95304-5000. The solicitation was posted on July 23, 2026, and responses are due by August 3, 2026. The contract falls under the Land Supplier Operations Vehicle Support organization of the Department of Defense, indicating the work supports defense logistics and vehicle-related infrastructure. There is no set-aside designation specified, meaning the opportunity is open to all eligible contractors. The successful bidder must demonstrate operational capability to meet and sustain NIST SP 800-171 requirements, including ongoing monitoring, documentation, and reporting to ensure continuous compliance. All systems handling CUI must be secured according to federal standards, and failure to maintain compliance could result in contract termination or loss of access to sensitive information.