Cybersecurity and Controlled Information Safeguarding

The contract requires implementation of NIST SP 800-171 security controls to protect covered defense information against unauthorized access, disclosure, or compromise, in full alignment with Defense Federal Acquisition Regulation Supplement (DFARS) requirements. This includes establishing and maintaining a robust cybersecurity posture across all systems handling controlled unclassified information, ensuring compliance with all 110 security controls outlined in NIST SP 800-171, such as access control, audit and accountability, configuration management, and incident response. The contractor must also establish and maintain procedures for timely reporting of any cyber incidents affecting covered defense information, including immediate notification and full cooperation with investigative efforts as mandated by DFARS. Performance is expected primarily at Fort Bliss, Texas, with a response deadline of August 13, 2026, and the contract is classified as a subcontract under NAICS code 541512 for Computer Systems Design Services. The contracting activity falls under the Department of Defense through C and T Supply Chain, requiring strict adherence to federal cybersecurity standards and accountability for safeguarding sensitive defense data throughout the contract lifecycle. Failure to comply with these controls or to report cyber incidents promptly may result in contract termination, financial penalties, or loss of eligibility for future DoD work.