Cybersecurity Compliance and Incident Reporting (CUI/CDI Safeguarding)

The contract requires full implementation of NIST SP 800-171 controls to protect Controlled Unclassified Information and Covered Defense Information, ensuring compliance with cybersecurity requirements mandated by DFARS 252.204-7012. This includes establishing robust mechanisms for detecting cyber incidents, responding to breaches in a timely manner, and reporting all incidents to the appropriate government authorities as specified in the regulation. All systems and processes handling CUI or CDI must be configured and maintained to meet the full scope of NIST control requirements without deviation. The subcontract is issued under the NAICS code 541512, targeting information technology services related to cybersecurity compliance. Performance is focused in San Diego, California, with a response deadline of July 31, 2026, and a posting date of July 20, 2026. The contracting entity is the Nuclear Reactor Program within the Department of Defense, and the work is expected to support defense-related operations requiring strict adherence to federal cybersecurity standards. Subcontractors must demonstrate proven capability in implementing and sustaining these controls, as failure to comply could result in contractual penalties or loss of eligibility for future defense work.