Cybersecurity and Information Safeguarding (for Subcontractors)

Subcontractors performing work for the ASC Commodities Division under the Department of Defense must implement and maintain cybersecurity controls aligned with NIST SP 800-171 to safeguard covered defense information processed, stored, or transmitted on their systems. Compliance requires the full adoption of all 110 security requirements outlined in the standard, including access control, audit, configuration management, and incident response measures. Subcontractors are obligated to report any cyber incidents affecting covered information within 72 hours of discovery, following the procedures specified in DFARS 252.204-7012, and must maintain detailed documentation to support self-assessments and potential government audits. Performance of all cybersecurity obligations must occur at Edwards Air Force Base with a zip code of 93524-8600, and contractors must be prepared to demonstrate ongoing compliance through records, policies, and system configurations. This subcontract opportunity, issued under NAICS code 541512, requires response by August 6, 2026, and applies specifically to entities engaged in information technology services supporting defense operations.