Cybersecurity Compliance & Incident Reporting (NIST SP 800-171)

This contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 to protect covered defense information. The effort encompasses full compliance with all specified security requirements, including the establishment of policies, procedures, and technical safeguards necessary to meet federal standards for information systems handling sensitive defense data. Incident reporting protocols must be in place and actively managed to ensure timely detection, response, and notification of any cybersecurity events that could compromise the integrity, confidentiality, or availability of covered defense information. The contractor is also responsible for flowdown of these NIST SP 800-171 requirements to all subcontractors involved in the performance of work, ensuring that every tier of the supply chain adheres to the same security standards. This includes verifying subcontractor compliance and maintaining documentation to demonstrate continuous adherence. The contract is issued under the Department of Defense through the Defense Logistics Agency, falls under NAICS code 541512 for computer systems design services, and is classified as a subcontract. The requirement is set to be active as of July 14, 2026, and execution is expected to be throughout the DoD enterprise regardless of geographic location.