NIST SP 800-171 Cybersecurity Compliance Implementation

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information across all systems and subcontractor environments. This includes comprehensive system hardening measures, strict access controls, detailed audit logging, and regular assessments to ensure continuous compliance. The work must be performed at Kittery, NH, with a focus on protecting sensitive information within the Department of Defense’s maritime network infrastructure. All subcontractors involved must adhere to the same security standards as the prime contractor to ensure end-to-end CUI protection. This is a Small Business Set Aside under NAICS code 541512, reserved exclusively for small businesses, with a response deadline of August 12, 2026. The contracting activity is managed by DLA Maritime in Portsmouth, and the contract falls under a subcontract structure, meaning the successful bidder will likely work under a larger prime contract holder. Full compliance with NIST SP 800-171 is mandatory, requiring documented policies, technical controls, and audit readiness at all times. Failure to meet these requirements could result in loss of eligibility, contractual penalties, or termination.