Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires full implementation of the NIST SP 800-171 security controls on all systems handling covered defense information, ensuring robust protection of sensitive data in alignment with federal cybersecurity standards. Compliance must be maintained throughout the performance period, with continuous monitoring and documentation to demonstrate adherence to each control requirement. Any cyber incident affecting these systems must be reported to the Defense Counterintelligence and Security Agency (DC3) within 72 hours of discovery, with timely and accurate reporting being a mandatory condition of performance. This subcontract is issued under the NAICS code 541612 and is performance-based, with the place of performance located in New Cumberland, Pennsylvania at the ZIP code 17070-5002. The solicitation was posted on July 23, 2026, and responses are due by August 3, 2026, with the contracting entity being the Electrical Devices Division within the Department of Defense. Failure to meet the cybersecurity requirements or miss the incident reporting window could result in contract noncompliance, financial penalties, or termination. All parties must ensure their systems, personnel, and procedures are fully prepared to meet these obligations prior to contract award.