Cybersecurity Compliance for Covered Defense Information

The contract requires the implementation of NIST SP 800-171 security controls and the establishment of cyber incident reporting procedures for systems that process, store, or transmit covered defense information, in full alignment with DFARS 252.204-7012 requirements. All subcontractor systems must be configured to meet the 110 security controls outlined in NIST SP 800-171, ensuring the confidentiality, integrity, and availability of sensitive defense data. Any cyber incident affecting these systems must be reported to the Department of Defense within 72 hours of discovery, including detailed documentation of the incident’s scope, impact, and actions taken. This subcontract is issued under the NAICS code 541512 for computer systems design services and is managed by the ASC Commodities Division of the Department of Defense. Performance is required to occur at the designated location in New Cumberland, Pennsylvania, with a zip code of 17070-5002. The solicitation was posted on July 21, 2026, and responses are due by July 29, 2026. Contractors must demonstrate proven experience in deploying and maintaining NIST 800-171 compliant environments and be prepared to provide evidence of compliance during contract execution. Failure to meet these requirements may result in contract termination or other remedial actions as stipulated by defense acquisition regulations.