Cybersecurity Compliance and Incident Reporting

The contract requires comprehensive cybersecurity compliance to implement and maintain NIST SP 800-171 security controls and achieve CMMC Level 2 readiness for systems handling controlled unclassified information. The contractor must establish and sustain processes to ensure continuous adherence to these standards, including regular assessments and documentation to demonstrate compliance. Additionally, the contract mandates timely cyber incident reporting through the DIBNet portal, requiring immediate notification and response protocols for any security breaches or anomalies involving covered information. The contractor is responsible for flowing down all applicable cybersecurity requirements to any subcontractors who handle controlled unclassified information, ensuring alignment with NIST SP 800-171 and CMMC Level 2 obligations across the entire supply chain. This includes verifying subcontractor compliance, maintaining oversight, and providing evidence of due diligence in enforcement. All activities must be performed in alignment with Department of Defense standards under the ASC Commodities Division, with the solicitation closing on May 2, 2026, and performance expected to begin shortly thereafter.