Cybersecurity Compliance for Covered Defense Information (CUI)

This contract requires subcontractors handling covered defense information to implement all applicable NIST SP 800-171 security controls to protect the confidentiality, integrity, and availability of controlled unclassified information. Compliance with the full set of 110 security requirements outlined in NIST SP 800-171 is mandatory, covering areas such as access control, audit and accountability, configuration management, identification and authentication, incident response, and system and communications protection. Subcontractors must also establish and maintain robust cyber incident reporting procedures to promptly notify the Department of Defense of any security breaches or potential compromises involving covered defense information, as required by DFARS clause 252.204-7012. The contract is specifically targeted at subcontractors within the defense supply chain operating under the NAICS code 541512 for computer systems design services and is performance-based at Fort Riley with a zip code of 66442-0000. The solicitation was posted on July 30, 2026, and responses must be submitted by August 10, 2026. All parties must ensure their systems, policies, and procedures are fully aligned with federal cybersecurity standards and are capable of sustaining ongoing compliance. Noncompliance may result in contract termination, financial penalties, or loss of eligibility to participate in future defense contracts.