Cybersecurity Compliance and Incident Reporting (NIST SP 800-171)

The contract requires implementation of NIST SP 800-171 security controls to safeguard covered defense information against unauthorized access, disclosure, or compromise, ensuring full compliance with Department of Defense cybersecurity standards. All applicable control requirements must be fully documented, integrated into existing systems, and maintained throughout the contract period, with continuous monitoring and periodic assessments to verify adherence. The contractor is obligated to report any cyber incidents promptly, in accordance with DFARS requirements, including timely notification, detailed incident analysis, and coordinated remediation efforts to mitigate impact and prevent recurrence. This is a subcontract under the SBA set-aside category, designated for small business entities, with a NAICS code of 541512 for computer systems design services. The performance location is identified as FPO with ZIP code 96694, indicating operations may involve overseas or mobile military support functions. The solicitation was posted on July 5, 2026, with a mandatory response deadline of July 16, 2026, and is managed by the Maritime Supply Chain office within the Department of Defense. Compliance with all technical, procedural, and reporting obligations is critical, and failure to meet these requirements may result in contract termination or penalties under federal acquisition regulations.