Cybersecurity Compliance for Covered Defense Information

This contract requires the implementation of NIST SP 800-171 controls to protect covered defense information in accordance with DFARS 252.204-7012, ensuring robust cybersecurity measures are in place to meet federal defense standards. The scope includes full compliance with access controls, audit and accountability mechanisms, configuration management, incident response procedures, and other critical security practices outlined in the NIST framework, with a mandatory requirement to report any cybersecurity incidents promptly and accurately. The work must be performed at a location in Phoenix, Arizona, under a small business set-aside classification, limiting eligibility to businesses certified as small by the SBA. The contract is structured as a subcontract under the Department of Defense’s Fluid Handling Division, solicited under NAICS code 541512 for other computer related services. Interested parties must respond by the deadline of August 14, 2026, and are expected to demonstrate proven experience in securing controlled unclassified information and managing cybersecurity compliance in defense environments. Performance will be evaluated based on technical capability to meet NIST and DFARS requirements, with emphasis on validated security controls, incident reporting protocols, and adherence to federal cybersecurity mandates without reliance on external documentation or third-party certifications not directly tied to the contract’s explicit obligations.