NIST SP 800-171 Compliance and Cybersecurity Assessment

The contract requires a comprehensive assessment and documentation effort to ensure compliance with NIST SP 800-171 standards for protecting Controlled Unclassified Information within the context of defense contracting. The work focuses on evaluating current cybersecurity practices and implementing necessary controls to safeguard CUI, aligning with federal requirements for contractors handling sensitive but unclassified data. The assessment must cover all 14 families of security requirements outlined in NIST SP 800-171, including access control, awareness and training, audit and accountability, configuration management, and incident response, among others, with the goal of achieving full compliance and documenting all findings and remediation efforts. This subcontract is issued under the Department of Defense with a place of performance in San Antonio, Texas, and falls under NAICS code 541512 for computer systems design services. The solicitation was posted on July 26, 2026, with a response deadline of August 3, 2026, indicating a short turnaround for proposals. The work involves detailed documentation to demonstrate that the contractor’s information systems meet federal standards for CUI protection, likely necessitating policy updates, technical implementation, staff training, and internal audit procedures. The expectation is for the subcontractor to provide verifiable evidence of compliance, enabling the prime contractor to fulfill its obligations under federal defense contracts involving sensitive information.