Cybersecurity Compliance for Covered Defense Information

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard covered defense information, ensuring compliance with federal cybersecurity standards mandated for defense contractors. All activities must align with DFARS clauses, which include conducting annual self-assessments to evaluate control effectiveness and promptly reporting any cyber incidents affecting protected data. The requirement applies to a small business set-aside subcontract under the SBA Total Small Business Set-Aside program, targeting firms classified as small businesses according to FAR 19.5. The NAICS code 541512 indicates the work involves computer systems design and related services, specifically focused on cybersecurity implementation and support. Performance of the contract is required to take place in Anchorage, with all obligations tied to the Department of Defense through the FA5000 673 Cons Lgc office. The solicitation was posted on June 26, 2026, and responses are due by July 13, 2026, at 7:00 AM. The contractor must be prepared to demonstrate continuous compliance with NIST controls and maintain documentation for audit or assessment purposes, with failure to meet these requirements potentially resulting in contract breach or loss of eligibility for future defense work. No specific point of contact or detailed location beyond the city of Anchorage is provided, indicating flexibility in internal operations as long as regulatory and performance obligations are fully met.