Cybersecurity Compliance and Incident Reporting

The contract requires full implementation of NIST SP 800-171 cybersecurity safeguards across all systems that handle covered defense information, ensuring compliance with federal standards for protecting sensitive data. This includes establishing robust access controls, encryption, audit logging, malware protection, and system configuration management to meet the baseline requirements for safeguarding controlled unclassified information. The subcontractor must also establish and maintain a formal cyber incident reporting process in accordance with DFARS 252.204-7012, enabling timely identification, reporting, and response to any security breaches or suspicious activities affecting covered systems. All activities are to be performed at the designated place of performance in New Cumberland, Pennsylvania, with a deadline to respond by August 7, 2026. The contract falls under NAICS code 541512 for computer systems design services and is issued under the U.S. Department of Defense, specifically the ASC SUPPLIER OPER AE AND AF DIV, as a subcontracting opportunity with no set-aside classification.