Cybersecurity & CUI Compliance Support

The contract requires implementation of NIST SP 800-171 Rev. 2 security controls to safeguard Controlled Unclassified Information (CUI) across all relevant systems and processes, ensuring full adherence to DFARS 252.204-7012 requirements for subcontractors handling defense-related information. This includes establishing and maintaining robust cybersecurity frameworks that address access control, identity management, audit logging, malware protection, and system hardening, all tailored to protect CUI from unauthorized access, disclosure, or modification. The contractor must also be prepared to rapidly detect, report, and respond to cyber incidents through the Defense Industrial Base Cybersecurity and Availability Reporting (DIBNet) platform and the Defense Counterintelligence and Security Agency's Defense Contracting Cyber Center (DC3), ensuring timely and accurate incident reporting in accordance with federal mandates. Performance is expected to be conducted in Philadelphia with a ZIP code of 19111, and the work falls under NAICS code 541512 for computer systems design services. The contract is structured as a subcontract under the Department of Defense, specifically managed by Navsup Weapon Systems Support, and is open for responses until May 26, 2026. Compliance with all cybersecurity and reporting obligations is mandatory, and failure to meet these requirements may result in contractual penalties or loss of eligibility for future DoD work. All activities must align with the federal government’s evolving standards for protecting CUI within the defense industrial base, emphasizing continuous monitoring, documentation, and operational readiness for cyber incident response.