Cybersecurity Compliance for Covered Defense Information

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 security safeguards to protect contract-related Controlled Unclassified Information handled by the contractor’s systems. Compliance with all 110 control requirements outlined in the standard is mandatory, ensuring that sensitive data is secured against unauthorized access, disclosure, or modification. The contractor must conduct an annual self-assessment to verify adherence to these safeguards and submit a completed assessment report as part of ongoing compliance obligations. Any cyber incident compromising the confidentiality, integrity, or availability of covered defense information must be reported to the appropriate government authority within 72 hours of discovery, including details on the nature, scope, and impact of the incident. The work is designated as a subcontract under NAICS code 541512 and is being managed by the Active Devices Division of the Department of Defense, with performance expected to occur in New Cumberland, Pennsylvania, ZIP 17070-5002. The solicitation was posted on July 29, 2026, with responses due by August 10, 2026, indicating a tight turnaround for potential bidders to demonstrate technical readiness, resource allocation, and established cybersecurity processes. While no set-aside classification is specified, the requirement is clearly targeted toward qualified defense subcontractors capable of handling sensitive government data under strict federal cybersecurity standards, with non-compliance potentially leading to termination or legal liability.