Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 cybersecurity controls to safeguard covered defense information, ensuring alignment with federal standards for protecting sensitive data within the defense supply chain. This includes the development and continuous updating of a System Security Plan and a Plan of Action and Milestones to document security posture, identify gaps, and track remediation efforts. The contractor must also establish and adhere to strict incident reporting protocols, promptly notifying relevant parties of any cybersecurity events or breaches affecting the covered information. Performance is localized at Fort Drum, New York, with the work falling under NAICS code 541512 for computer systems design services. The contract is structured as a subcontract under the Department of Defense's Electrical Devices Division and is open for bid with a submission deadline of August 7, 2026. Compliance with all NIST controls is mandatory, and failure to meet requirements may result in contractual penalties or loss of eligibility to handle protected defense data. The contractor must demonstrate the capability to sustain security controls over time and respond effectively to evolving cyber threats while maintaining full documentation and audit readiness.