Cybersecurity Compliance for Covered Contractor Systems

The contract requires implementation and maintenance of NIST SP 800-171 security controls on all contractor systems that process, store, or transmit covered defense information, ensuring alignment with federal cybersecurity standards for protecting sensitive government data. Contractors must establish, document, and sustain a comprehensive security posture across their networks and IT environments, including access controls, audit capabilities, system integrity protections, and configuration management, all aligned with the NIST framework. Compliance is mandatory and subject to ongoing monitoring and assessment to confirm continued adherence throughout the contract period. In addition to control implementation, the contract mandates strict adherence to DFARS cyber incident reporting obligations, requiring immediate notification and detailed documentation of any suspected or confirmed cybersecurity breaches involving covered defense information. Contractors are responsible for detecting, responding to, and reporting incidents to the Department of Defense within the prescribed timeframes and using approved reporting mechanisms. Performance is tied to the contractor's ability to demonstrably maintain security controls and meet incident response deadlines, with failure to comply potentially resulting in contract termination or financial penalties. The work is to be performed at the New Cumberland, Pennsylvania location, under the oversight of the Department of Defense’s DDSP New Cumberland Facility.