Cybersecurity Safeguarding for Contractor Systems

Contractors must implement all NIST SP 800-171 safeguarding controls on information systems that process, store, or transmit federal contract information to ensure compliance with federal cybersecurity standards. This subcontract requires the full adoption of the 110 security controls outlined in NIST SP 800-171, covering areas such as access control, audit and accountability, configuration management, identification and authentication, and incident response to protect sensitive data from unauthorized access or compromise. The work is intended for systems handling information related to U.S. Department of Defense contracts under NAICS code 541512, which pertains to computer systems design services, and performance must be completed in alignment with DOD cybersecurity requirements regardless of physical location. The solicitation was posted on July 14, 2026, with responses due by July 22, 2026, and the contract is managed by the ASC Commodities Division under the Department of Defense. There is no set-aside designation specified, meaning the opportunity is open to all eligible contractors without restriction based on business size or category. The place of performance is not defined by specific geographic constraints, allowing work to be conducted wherever the contractor’s systems are located, as long as all controls are effectively enforced. Contractors must ensure their systems, personnel, and processes fully comply with NIST SP 800-171 prior to system deployment or data handling, and failure to meet these requirements could result in contract termination or penalties under federal acquisition regulations.