Cybersecurity & Controlled Unclassified Information (CUI) Safeguarding

The contract requires full implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information across all subcontracted activities involving covered defense information. This includes establishing, maintaining, and enforcing a comprehensive cybersecurity framework that meets federal standards for protecting CUI, with a strong emphasis on access control, audit and accountability, configuration management, and incident response. All subcontractors must ensure their systems and processes are compliant with DFARS 252.204-7012, which mandates specific cybersecurity requirements and reporting obligations for defense contractors working with sensitive government data. Any cybersecurity incident affecting covered defense information must be reported promptly in accordance with federal guidelines, including timely notification to the Department of Defense and cooperation in investigative efforts. The subcontractor is responsible for ensuring that all third-party vendors and partners handling CUI adhere to the same stringent protections, extending compliance requirements throughout the supply chain. The work is classified under NAICS code 541512 for computer systems design services and is issued by the Department of Defense, specifically the Pennsylvania Defense Logistics Agency Aviation at Philadelphia, with responses due by May 28, 2026.