Cybersecurity Compliance for Contractor Information Systems (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls on all contractor information systems that handle covered defense information. This includes establishing technical, administrative, and physical safeguards to protect sensitive data from unauthorized access, disclosure, or compromise. Compliance with all 110 controls outlined in NIST SP 800-171 is mandatory, and the contractor must ensure these measures are continuously monitored, documented, and updated as threats evolve or systems change. The contractor is also responsible for supporting Department of Defense assessment activities, including providing evidence of control implementation and participating in any required self-assessments or third-party evaluations. In addition to security control implementation, the contractor must establish and maintain robust incident reporting procedures in alignment with DoD requirements. Any security incident involving covered defense information must be promptly detected, reported, and investigated in accordance with established timelines and protocols. The contractor's systems must be capable of logging, preserving, and transmitting necessary forensic data to support DoD investigative efforts. Performance is tied to the location of New Cumberland, Pennsylvania, and the work falls under NAICS code 541512, indicating that the scope involves computer systems design and related services. The solicitation closed on August 21, 2026, and the contract is structured as a subcontract under the Department of Defense’s Land Supply Chain initiative.