Cybersecurity Compliance and Incident Reporting

The contract requires full implementation of NIST SP 800-171 Rev 2 controls to safeguard Controlled Unclassified Information (CUI) across all systems and processes involved in the performance of work under this agreement. Compliance with these cybersecurity standards is mandatory, ensuring that sensitive data is protected through technical, administrative, and physical safeguards as defined by the National Institute of Standards and Technology. In addition to implementing the controls, the contractor must establish and maintain procedures to detect, report, and respond to cyber incidents involving CUI, with all incidents required to be reported to the Department of Defense within 72 hours of discovery. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, classified under NAICS code 541512, indicating it is related to computer systems design and associated services. The place of performance is specified as New Cumberland, Pennsylvania, with a ZIP code of 17070-5002. The contract was posted on July 27, 2026, and responses are due by July 30, 2026, leaving a narrow window for submission. The contracting activity falls under the Nuclear Reactor Program within the Department of Defense, underscoring the critical nature of the CUI being protected and the urgency of cybersecurity readiness in a high-consequence environment.