NIST SP 800-171 Cybersecurity Compliance (If Handling Controlled Data)

The contract requires implementation of NIST SP 800-171 cybersecurity controls to safeguard controlled unclassified information (CUI) when the subcontractor handles such data, ensuring compliance with federal protection standards. This obligation applies specifically to subcontractors involved in operations that involve CUI, mandating adherence to a defined set of security requirements covering access control, audit and accountability, identification and authentication, and system and communications protection among others. The requirement is tied to a subcontract under the Department of Defense, issued by DLA Dist San Joaquin, with performance located in Tracy, California, 95304-5000, and is governed under the NAICS code 541512 for custom computer programming services. The solicitation is open for responses through July 20, 2026, with a posted date of July 9, 2026, and is accessible via the DIBBS platform. As a subcontract opportunity, it does not include a set-aside classification, meaning all eligible organizations may compete without restrictions based on business size or type. No point of contact is listed, but interested parties must review and respond to the full solicitation details through the provided UI link to ensure full compliance with submission requirements and to confirm applicability of CUI handling responsibilities. Completion of NIST SP 800-171 controls is mandatory for any subcontractor whose scope of work involves processing, storing, or transmitting controlled unclassified information on behalf of the Department of Defense.