Cybersecurity Compliance & Incident Reporting

This contract requires the implementation of NIST Special Publication 800-171 cybersecurity controls to protect covered defense information on nonfederal systems, ensuring alignment with federal standards for safeguarding sensitive data. The contractor must establish and maintain a comprehensive cybersecurity framework that meets all applicable requirements under NIST SP 800-171, including access control, audit and accountability, configuration management, and incident response measures. Compliance must be demonstrated through documented policies, procedures, and technical safeguards validated to the standards outlined in the publication. In addition to implementing the controls, the contractor is obligated to report any cyber incidents involving covered defense information within 72 hours of discovery, providing full detail of the nature, scope, and impact of the incident to the appropriate government entities. The contract is structured as a small business set-aside under SBA guidelines, specifically reserved for total small businesses, and falls under the NAICS code 541512 for computer systems design services. The solicitation is issued by the Department of Defense’s Strategic Acquisition Program Directorate, with a response deadline of July 28, 2026, and is intended for subcontracting purposes under a broader defense acquisition effort.