Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST Special Publication 800-171 security controls to protect controlled unclassified information within systems supporting Department of Defense operations. Compliance with these standards is mandatory and must be sustained throughout the life of the subcontract, with continuous monitoring and documentation to ensure adherence. Any cybersecurity incidents involving covered defense information must be reported to the Department of Defense within 72 hours of discovery, in strict accordance with DFARS 252.204-7012 requirements. The work is tied to a subcontract under the NAICS code 541512, with performance occurring at a designated location in New Cumberland, Pennsylvania, under the oversight of the Active Devices Division. The solicitation is open for responses until July 20, 2026, with the opportunity posted on July 9, 2026, and is accessible through the DIBBS platform. The contract does not specify a set-aside designation, indicating it is open to any qualified subcontractor regardless of business size or status. Failure to meet the NIST 800-171 control requirements or to meet the 72-hour incident reporting window may result in contract noncompliance, penalties, or termination. The nature of the work demands a robust cybersecurity framework, documented procedures, and a responsive incident management process aligned with federal defense standards.