Cybersecurity Compliance and CUI Safeguarding

The contract requires full implementation of NIST SP 800-171 controls to protect Covered Defense Information, ensuring that all systems handling such data meet federal cybersecurity standards for safeguarding Controlled Unclassified Information. A comprehensive System Security Plan must be developed and maintained to document security policies, procedures, and controls aligned with NIST guidelines, providing a clear framework for ongoing compliance and audit readiness. Additionally, the contractor is obligated to report any cyber incidents involving CDI within 72 hours of discovery, in strict accordance with DFARS 252.204-7012, to enable timely response and mitigation of potential threats to national security information. This is a small business set-aside subcontract under NAICS code 541512, awarded by the Department of Defense through the Maritime Supply Chain office, with performance required at New Cumberland, Pennsylvania, zip code 17070-5002. The solicitation closed on July 27, 2026, and was posted on July 16, 2026, indicating a narrow window for response. Compliance with all cybersecurity requirements is mandatory, and failure to meet NIST controls, SSP documentation standards, or the 72-hour reporting obligation could result in contract termination, financial penalties, or loss of eligibility for future DoD work. The subcontractor must possess demonstrated experience in handling CDI and implementing federal cybersecurity frameworks to qualify for award.