Cybersecurity & CUI Protection for Subcontractors

Subcontractors handling covered defense information under this contract must fully implement the cybersecurity controls outlined in NIST Special Publication 800-171 to protect controlled unclassified information. They are required to maintain an up-to-date System Security Plan that documents how these controls are applied and enforced across their information systems. Any cyber incident involving the compromise or suspected compromise of covered defense information must be reported to the appropriate government authority within seventy-two hours of discovery. This requirement applies regardless of the size or scope of the subcontractor’s involvement, and noncompliance may result in contract termination or other adverse actions. The work is tied to a Department of Defense facility located in New Cumberland, Pennsylvania, with a NAICS code of 541512 indicating that the services pertain to computer systems design and related activities. The solicitation closed on July 20, 2026, and all parties awarded must ensure systems, personnel, and procedures meet these cybersecurity standards before commencing work.