Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires full implementation and ongoing maintenance of the cybersecurity controls outlined in NIST SP 800-171 to protect Controlled Unclassified Information. The contractor must develop and maintain a comprehensive System Security Plan that documents how these controls are applied across systems and processes handling such data. All assessments of compliance must be submitted to the Supplier Performance Risk System to ensure visibility and accountability within the Department of Defense supply chain. Additionally, the contractor is obligated to promptly report any cyber incidents involving Controlled Digital Information, in accordance with federal reporting requirements, to mitigate potential threats and enable timely response actions. This engagement is governed as a subcontract under the NAICS code 541612 and is performance-bound to New Cumberland, Pennsylvania, with all activities tied to the Defense Logistics Agency’s procurement framework.