Cybersecurity Compliance and Incident Reporting

The contract requires the implementation of all NIST SP 800-171 cybersecurity controls to safeguard covered defense information, ensuring compliance with federal standards for protecting sensitive data within the defense supply chain. All subcontractors must establish and maintain robust security measures aligned with these controls to prevent unauthorized access, disclosure, or compromise of information. In addition to ongoing compliance, the contractor is obligated to report any detected cyber incidents to the appropriate authorities within 72 hours of discovery, regardless of the incident’s perceived severity or impact. This subcontract is issued under the Department of Defense through the Maritime Supply Chain organization and is tied to a performance location in New Cumberland, Pennsylvania, with a NAICS code of 541512 indicating it pertains to computer systems design services. The solicitation was posted on July 23, 2026, and responses are due by August 3, 2026, under a subcontract structure with no set-aside classification. Contractors must be prepared to demonstrate full adherence to the NIST framework and maintain documentation for verification, as failure to meet incident reporting deadlines or control requirements may result in contract penalties or termination.