Cybersecurity Compliance for Covered Defense Information (CUI)

The contract requires the implementation of NIST SP 800-171 security controls to protect Covered Unclassified Information (CUI) and ensure compliance with DFARS 252.204-7012, which governs the safeguarding of controlled unclassified information in nonfederal systems. This subcontract is centered on establishing and maintaining a robust cybersecurity posture that meets federal standards for handling sensitive defense-related data, including proper access controls, audit logging, malware protection, configuration management, and incident response procedures. The contractor must be prepared to report any cyber incidents involving CUI in accordance with the mandated reporting timeline and procedures outlined in the DFARS clause. The contract is associated with the Department of Defense and will be performed at a location in Jacksonville, Florida, with a North American Industry Classification System code of 541512 indicating information technology services. The solicitation was posted on August 9, 2026, and responses are due by August 20, 2026. This subcontract does not specify any set-aside status and is part of a broader effort to enforce cyber resilience across the defense industrial base. Compliance is not optional; failure to implement the required controls or report incidents properly may result in contract termination or penalties.