Cybersecurity & Covered Defense Information Protection

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 cybersecurity controls to safeguard covered defense information, ensuring compliance with federal standards for protecting sensitive data within the defense supply chain. All subcontractors must establish and sustain a secure environment that meets the full suite of NIST controls, including access management, audit logging, entity authentication, and system and communications protection, with continuous monitoring and remediation processes in place. Failure to maintain these controls could result in noncompliance and potential termination of the agreement. In addition to safeguarding data, the contract mandates immediate reporting of any cyber incident affecting covered defense information, with all incidents required to be reported to the appropriate government authorities within 72 hours of discovery. This includes providing timely notifications, detailed incident documentation, and cooperation with any subsequent investigation or mitigation efforts. The work is performance-based at the location in New Cumberland, Pennsylvania, under a subcontract arrangement through the Department of Defense’s ASC Commodities Division, and respondents must submit proposals by the August 5, 2026 deadline, with the North American Industry Classification System code 541512 indicating information technology services related to systems design and development.