Cybersecurity and Covered Defense Information Safeguarding

The contract requires full implementation of DFARS 252.204-7012 and NIST SP 800-171 security controls to protect Covered Defense Information and Controlled Unclassified Information within the contractor’s systems. This includes developing and maintaining a comprehensive system security plan, establishing procedures for timely incident reporting, and managing ongoing compliance through continuous monitoring and documentation. All activities must align with Department of Defense cybersecurity requirements to ensure the integrity, confidentiality, and availability of sensitive data handled under the subcontract. Performance is mandated to occur in Madison, Wisconsin, with a response deadline of August 17, 2026, and the contract falls under NAICS code 541512 for computer systems design services. The contracting entity is the Department of Defense under the Construction & Equipment MRO SVC I program, and the subcontractor must be prepared to demonstrate full adherence to federal cybersecurity standards without reliance on special set-aside provisions. The obligation extends beyond technical implementation to include audit readiness, personnel training, and documentation of all security controls as part of a robust compliance management framework.