Cybersecurity Compliance for Covered Defense Information

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect covered defense information as mandated by DFARS 252.204-7012. This includes establishing technical, administrative, and physical safeguards to ensure the confidentiality, integrity, and availability of sensitive data handled under the agreement. The contractor must also be prepared to fulfill all cyber incident reporting obligations, promptly notifying the appropriate authorities of any breaches or suspicious activities affecting covered defense information. Performance of this subcontract will be carried out at the designated location in Williamsburg, Virginia, with the North American Industry Classification System code 541512 indicating it falls under computer systems design and related services. The procurement is issued by the Department of Defense under LSO Combat Vehicles and Armament, and is structured as a subcontract, meaning it will be awarded to a vendor supporting a prime contractor. Responses must be submitted by July 31, 2026, with the solicitation posted on July 20, 2026. Failure to meet the NIST controls or incident reporting requirements could result in noncompliance penalties and potential loss of contract eligibility.