Cybersecurity Compliance and CUI Protection

The contract requires the implementation, assessment, and documentation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information across all applicable systems and processes. This includes ensuring full compliance with the specified framework, conducting thorough evaluations of control effectiveness, and maintaining complete documentation to demonstrate adherence. Reporting obligations extend to the Supply Chain Risk Management Performance System (SPRS), where accurate and timely submissions are mandatory to maintain contractual standing and demonstrate ongoing compliance. Additionally, the contractor must flow down all applicable CUI protection requirements to any subcontractors, ensuring that third-party entities handling CUI adhere to the same rigorous standards and maintain equivalent levels of security across the supply chain. The work is to be performed at a designated location in New Cumberland, Pennsylvania, with a response deadline of May 21, 2026, under a subcontract structure aligned with NAICS code 541512 for information technology services.