Cybersecurity Compliance (NIST SP 800-171)

The contract requires implementation and documentation of NIST SP 800-171 controls to protect Controlled Unclassified Information within the contractor’s systems, ensuring alignment with Department of Defense cybersecurity requirements under DFARS clauses. This includes conducting a comprehensive self-assessment of all 110 security controls outlined in NIST SP 800-171, documenting implementation evidence, and formally reporting the assessment results to demonstrate compliance. The effort must be executed in accordance with federal standards, focusing on safeguarding CUI wherever it is processed, stored, or transmitted, with an emphasis on continuous monitoring and corrective action planning where gaps are identified. The contract is a subcontract under the NAICS code 541512 for other computer-related services and is tied to performance location in Tracy, California, with a response deadline of August 3, 2026. All activities must be completed by the contractor to meet federal compliance deadlines, and failure to properly implement or report on NIST controls may result in contract non-compliance or termination. The work is managed under the DoD’s procurement system, and all deliverables must be structured to support audit readiness and verification by government representatives, with no set-aside designation applicable.