Cybersecurity Compliance Support (NIST SP 800-171)

The contract requires the implementation and assessment of NIST Special Publication 800-171 security controls to safeguard Controlled Unclassified Information within non-federal information systems, ensuring alignment with Defense Federal Acquisition Regulation Supplement requirements. This includes the development and maintenance of a System Security Plan that documents the organization’s security posture, risk management strategies, and control implementation status across all relevant systems and environments. The work must demonstrate full compliance with DFARS clauses related to CUI protection, covering technical, administrative, and physical security measures as defined by NIST SP 800-171. The effort is structured as a subcontract under the Department of Defense’s Active Devices Division, with a focus on enabling contractors to meet federal cybersecurity obligations without direct government oversight. The solicitation is open for response until July 27, 2026, and is classified under NAICS code 541611, indicating it pertains to management, scientific, and technical consulting services related to cybersecurity. There is no set-aside classification specified, and performance may occur across unspecified locations, with the contractor expected to deliver a certified, auditable compliance posture that can be validated by the government or its authorized representatives.