Cybersecurity Compliance and SPRS Reporting

The contract requires full implementation of NIST SP 800-171 cybersecurity controls to ensure compliance with federal standards for protecting controlled unclassified information. The contractor must conduct a thorough self-assessment of their security posture based on these controls and submit the resulting score and documentation to the Supplier Performance Risk System, or SPRS, as the official repository for contractor cybersecurity evaluations. In addition to compliance reporting, the contractor is obligated to establish and maintain robust cyber incident response procedures that mandate reporting of any security incident within 72 hours and the preservation of forensic images of affected systems for potential investigation and analysis. All activities must be performed in alignment with Department of Defense requirements and are tied to performance at the specified location in Portsmouth, Virginia, under a subcontract framework governed by NAICS code 541512 for computer systems design services. The solicitation is open for response until July 27, 2026, with an emphasis on adherence to timelines and accuracy in documentation to meet federal cybersecurity obligations.