Cybersecurity for Controlled Unclassified Information (CUI)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information within contractor systems, ensuring compliance with federal standards for data protection. This includes establishing technical, administrative, and physical safeguards to prevent unauthorized access, disclosure, or compromise of CUI, as well as maintaining detailed documentation to demonstrate adherence to all required controls. Contractors must be prepared to report any cybersecurity incidents promptly and provide comprehensive compliance records upon request, ensuring continuous alignment with federal cybersecurity obligations. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, classified under NAICS code 541512 for computer systems design services, and issued by the Department of Defense’s Strategic Acquisition Program Directorate. The opportunity is open for responses until August 12, 2026, with performance expected to occur in support of federally mandated cybersecurity requirements. All eligible small business contractors must demonstrate the capability to meet the full scope of NIST SP 800-171 implementation, incident reporting protocols, and ongoing compliance verification without reliance on large business partners.