Cyber Incident Reporting and CUI Safeguarding

This contract requires the implementation of NIST SP 800-171 security controls to safeguard covered defense information and ensure compliance with federal cybersecurity standards. The subcontractor must establish and maintain a robust security framework that aligns with the requirements for protecting controlled unclassified information, including access controls, audit logging, media protection, personnel security, and system and communications protection measures. All activities must be performed at the designated place of performance in New Cumberland, Pennsylvania, with strict adherence to the timeline outlined in the solicitation. The contractor is also obligated to report any cyber incidents involving covered defense information promptly and in accordance with established DoD protocols. This includes identifying, documenting, and notifying relevant authorities of security breaches or unauthorized access, as well as preserving evidence and cooperating with investigations. Compliance with the NIST framework and timely incident reporting are mandatory conditions of performance under this subcontract, and failure to meet these requirements may result in contract termination or other enforcement actions. The NAICS code 541512 indicates that the work falls under computer systems design services, emphasizing the technical nature of the cybersecurity obligations.