Cybersecurity for Contractor Information Systems

The contract requires the implementation of foundational cybersecurity safeguards on information systems that process, store, or transmit Controlled Unclassified Information, in full compliance with the National Institute of Standards and Technology Special Publication 800-171 and the specific contractual clause 52.240-93. This mandate applies to all contractor systems handling CUI and necessitates the adoption of defined security controls including access control, audit and accountability, configuration management, identification and authentication, maintenance, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. The subcontract is issued by the ASC Commodities Division under the Department of Defense and is performance-based at Rapid City, South Dakota, with a ZIP code of 57703-8708. All work must be completed in alignment with federal cybersecurity standards to ensure consistent and measurable protection of sensitive but unclassified government data. The solicitation was posted on July 16, 2026, with a strict response deadline of July 24, 2026, indicating a short and urgent acquisition timeline. The NAICS code 541512, which corresponds to Custom Computer Programming Services, suggests the work involves technical implementation and integration of security controls into existing or newly developed software systems. The contract is classified as a subcontract, meaning the awardee will likely provide services or technical support under a prime contractor or larger DoD initiative. No set-aside designation is specified, implying the opportunity is open to all eligible entities. The place of performance is fixed at Rapid City, and compliance with NIST SP 800-171 is non-negotiable, requiring documented implementation, continuous monitoring, and potential audit readiness throughout the contract period.