Cybersecurity Compliance for Covered Defense Information (CUI)

The contract requires full implementation of NIST SP 800-171 security controls and adherence to DFARS 252.204-7012 regulations to protect Covered Defense Information on contractor systems. This includes developing a System Security Plan that documents all implemented safeguards, ensuring continuous compliance with federal cybersecurity standards for handling Controlled Unclassified Information. Contractors must establish processes for timely detection, reporting, and response to any cybersecurity incidents involving CUI, as mandated by the DFARS clause. Performance is expected to be executed at the designated location in New Castle, Pennsylvania, with all work tied to the NAICS code 541512 for computer systems design services. The subcontract is part of a Department of Defense initiative managed by the Aviation Supply Chain ESOC Buys office, and responses must be submitted by the stated deadline of July 31, 2026. Compliance is non-negotiable, and failure to meet these requirements will result in contract non-performance, with all systems and procedures subject to verification and assessment by federal authorities.