Cybersecurity Compliance and CUI Safeguarding (Subcontractor Flow-Down)

This subcontract requires full implementation of NIST SP 800-171 controls to safeguard Covered Defense Information, ensuring that all technical work performed under the agreement meets federal cybersecurity standards for protecting Controlled Unclassified Information. The contractor must establish and maintain robust security practices covering access control, audit and accountability, configuration management, identification and authentication, incident response, media protection, and system and communications protection, among others, as specified by the NIST framework. Any cyber incidents involving CDI must be reported promptly in accordance with federal reporting requirements, and all affected media must be preserved for forensic analysis and regulatory compliance. The scope of work is tied to subcontracted technical activities performed at the designated place of performance in New Cumberland, Pennsylvania, with the requirement flowing down from the Department of Defense through the Land Supply Chain. Compliance is mandatory and non-negotiable, with failure to implement the required controls or report incidents potentially resulting in contract termination or legal consequences. The solicitation period closed on July 30, 2026, and all contractors bidding on or awarded this subcontract must demonstrate proven capability and documented adherence to NIST 800-171 prior to performance authorization, ensuring consistent and secure handling of sensitive defense information across the supply chain.