Cybersecurity Compliance and Reporting (NIST SP 800-171 / CMMC)

The contract requires full implementation and documentation of NIST Special Publication 800-171 security controls to safeguard covered defense information in alignment with DFARS 252.204-7012 requirements. This includes establishing robust cybersecurity practices across all systems handling controlled unclassified information, ensuring compliance with access controls, audit and accountability measures, configuration management, and incident response protocols. The contractor must also maintain comprehensive records to demonstrate adherence to these standards and be prepared for assessment under the Cybersecurity Maturity Model Certification framework. Additionally, the contract mandates immediate and accurate cyber incident reporting in accordance with the specified DFARS clause, requiring timely notification of any security breaches or anomalies affecting covered defense information. Performance is tied to Fort Campbell, Kentucky, with the work falling under NAICS code 541512 for computer systems design services. The subcontract is tied to the Department of Defense under Medical Supply Chain FSH and requires submission of responses by July 27, 2026, with all activities centered on strengthening the defense industrial base's cybersecurity posture against evolving threats.