Cybersecurity Compliance (NIST SP 800-171)

The contract requires implementation of NIST SP 800-171 security controls for the protection of Controlled Unclassified Information (CUI), mandating full compliance through the development of a System Security Plan, completion of a self-assessment, and maintenance of a Plan of Action and Milestones to address gaps. These requirements apply to all activities conducted under the subcontract, with performance specifically tied to the location in New Cumberland, Pennsylvania, and must be fulfilled by the proposal deadline of May 21, 2026. The work falls under NAICS code 541512, indicating it involves computer systems design services for the Department of Defense’s ASC Commodities Division, and is not subject to any specific set-aside categories. Compliance is non-negotiable and must be demonstrated through documented evidence of each required control, including ongoing risk management, continuous monitoring, and regular updates to the POA&M as new vulnerabilities or changes arise. The subcontractor is expected to establish and maintain a robust cybersecurity posture aligned with federal standards, ensuring that CUI is handled, stored, and transmitted securely throughout the lifecycle of the contract. Failure to meet these requirements may result in non-compliance penalties, termination of performance, or loss of eligibility for future DoD work.