Cybersecurity Compliance and Incident Reporting (NIST SP 800-171)

The contract requires implementation and maintenance of all NIST SP 800-171 security controls to safeguard covered defense information handled by the contractor. This includes establishing and sustaining a robust cybersecurity posture aligned with federal standards for protecting sensitive government data on nonfederal information systems. The contractor must ensure continuous compliance with these controls and be prepared to demonstrate adherence upon request. Any cyber incident affecting covered defense information must be reported to the Defense Cyber Crime Center within 72 hours of discovery, with full details provided as required. The work is performed under a subcontract in Norfolk, Virginia, with a place of performance specified at ZIP code 23511. The contract is associated with NAICS code 541611, indicating services related to computer systems design and related activities, and is issued by the Department of Defense through MSCHQ Norfolk. Responses are due by July 2, 2026, at 7:00 PM, and the contract is posted on SAM.gov with a public link for reference. There is no set-aside designation listed, and the contracting office has not identified a point of contact.