Cybersecurity Compliance and Incident Reporting

The contract requires full implementation of NIST Special Publication 800-171 security controls to safeguard covered defense information handled by the subcontractor, ensuring compliance with federal cybersecurity standards for protecting sensitive federal data. All security measures must be operational and documented to meet the required baseline for information systems processing, storing, or transmitting controlled unclassified information related to defense projects. Failure to meet these controls could result in noncompliance and potential termination of the subcontract. The subcontractor is obligated to report any cyber incidents affecting covered defense information within 72 hours of discovery, providing detailed forensic data and impact assessments as required. The performance location is fixed at New Cumberland, Pennsylvania, with the work falling under NAICS code 541512 for computer systems design services. The solicitation closed on August 21, 2026, following a posting date of August 10, 2026, and is issued under the Department of Defense, specifically the Nuclear Reactor Program, as a subcontract under an existing prime contract vehicle.