Cybersecurity & CUI Safeguarding for Subcontractors

The contract requires subcontractors to implement all NIST SP 800-171 security controls to safeguard Controlled Unclassified Information within their systems, ensuring compliance with federal cybersecurity standards. This includes developing and maintaining a documented system security plan, applying access controls, conducting risk assessments, and establishing continuous monitoring practices to protect CUI from unauthorized access, disclosure, or modification. Subcontractors must also establish procedures for prompt detection, reporting, and response to cyber incidents, adhering to mandated timelines and protocols for notification to the Department of Defense. Performance is required at the designated location in New Cumberland, Pennsylvania, with a compliance deadline of July 29, 2026. The contract falls under NAICS code 541512 for computer systems design services and is issued by the Department of Defense’s ASC Supplier Oper AE and AF Division. All work must align with defense contracting cybersecurity requirements, and subcontractors are expected to have the technical capability and security infrastructure to meet these stringent protections without reliance on external certifications beyond the NIST 800-171 framework. The contract is structured as a subcontract and does not include set-aside provisions, making it open to all qualified entities capable of fulfilling the cybersecurity obligations outlined.