Cybersecurity and CDI Safeguarding

The contract requires implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information handled by the contractor, ensuring compliance with federal cybersecurity standards for protecting sensitive unclassified information related to DoD operations. All systems and processes must be configured to meet the full scope of the NIST framework, including access control, audit accountability, incident response, and data encryption, to mitigate risks associated with unauthorized access or data breaches. The contractor is obligated to detect, report, and respond to any cyber incident involving Covered Defense Information within 72 hours of discovery, following established DoD protocols for incident reporting and forensic documentation. This subcontract, issued by the ASC Commodities Division under the Department of Defense, pertains to work performed at the place of performance in New Cumberland, Pennsylvania, with a NAICS code of 541512 indicating IT services and related consulting. The solicitation was posted on July 20, 2026, and responses are due by July 28, 2026, with no set-aside classification specified. Compliance with the contractual cybersecurity mandates is non-negotiable and directly tied to the contractor’s ability to handle federal defense information. Failure to adhere to the required controls or timely incident reporting may result in contract termination, penalties, or loss of eligibility for future DoD work.