Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 for systems that process, store, or transmit covered defense information. Compliance with these controls is mandatory and must be sustained throughout the contract period to ensure the protection of sensitive data as defined under DFARS 252.204-7012. The contractor is responsible for establishing a robust security framework that includes access control, audit logging, configuration management, incident response, and continuous monitoring, all tailored to meet federal requirements for safeguarding unclassified information on nonfederal systems. In addition to implementing the controls, the contractor must establish and maintain procedures for timely incident reporting in accordance with DFARS 252.204-7012, ensuring any cybersecurity events affecting covered defense information are reported to the Department of Defense within required timeframes. The work is classified as a subcontract under NAICS code 541512, with performance expected at the FPO location with ZIP code 96322. The solicitation was posted on August 10, 2026, and responses are due by August 21, 2026, under the oversight of the Department of Defense’s Maritime Supply Chain ESOC Buys organization. All activities must remain fully compliant with federal cybersecurity standards and contractual obligations throughout the term of performance.