NIST SP 800-171 DoD Assessment Compliance (If Handling CUI)

This contract requires the subcontractor to implement all necessary security controls outlined in NIST SP 800-171 to safeguard Controlled Unclassified Information (CUI) that may be handled as part of their work with the Department of Defense. Compliance with these controls is mandatory and must be fully operational prior to any assessment, ensuring the protection of sensitive but unclassified data throughout the subcontractor’s systems and processes. The subcontractor must be prepared to undergo a formal DoD assessment to validate adherence to the NIST standard, and failure to meet requirements may result in termination or loss of eligibility for future work. The contract is classified as a subcontract under the NAICS code 541512, tied to the Maritime Supply Chain within the Department of Defense, and has a narrow response window with a deadline of July 24, 2026. There is no set-aside designation, and performance is not restricted to a specific geographic location. The subcontractor must ensure all technical, administrative, and physical safeguards defined by NIST SP 800-171 are documented, implemented, and maintained to meet DoD expectations, with readiness for inspection being a condition of participation. All activities must align with federal cybersecurity standards applicable to non-federal systems handling CUI.