Cybersecurity Safeguards for CUI Handling

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) across all system environments, with a specific focus on developing a System Security Plan (SSP) that documents policies, procedures, and technical safeguards aligned with federal standards. Contractors must ensure full compliance with all 110 controls outlined in the publication and establish processes for continuous monitoring and documentation of security posture. Cyber incident reporting is mandatory, requiring immediate detection and notification to the appropriate federal authorities within 72 hours of identifying any breach, compromise, or suspicious activity involving CUI. Performance is centered at Fort Irwin, California, with the work structured as a subcontract under the Defense Logistics Agency, part of the Department of Defense. The contract falls under NAICS code 541512 for custom computer programming services and was posted on July 20, 2026, with proposals due by July 27, 2026. All work must adhere to federal cybersecurity directives and be executed in a manner that ensures the integrity, confidentiality, and availability of CUI throughout its lifecycle, with no deviation from the required reporting timelines or control implementation standards.