Cybersecurity and Covered Defense Information Protection

The contract requires full implementation of NIST SP 800-171 controls to safeguard covered defense information against unauthorized access, disclosure, or compromise, ensuring compliance with federal cybersecurity standards for contractors handling sensitive defense data. All subcontractors must establish and maintain the specified security controls within their information systems, covering areas such as access control, audit, configuration management, identification and authentication, and incident response, with ongoing monitoring and documentation to validate adherence. In addition to securing information, the contract mandates strict adherence to a 72-hour cyber incident reporting requirement, obligating immediate notification upon detection of any security breach, anomaly, or suspected compromise involving covered defense information. Failure to report within this window may result in contract repercussions, and all actions taken to contain, mitigate, and remediate incidents must be fully documented and submitted to the appropriate authorities. The subcontract falls under NAICS code 541512 and is issued by the Department of Defense’s Strategic Acquisition Program Directorate, with responses due by August 7, 2026.