Cybersecurity Compliance for Covered Defense Information (NIST SP 800-171)

The contract requires full implementation and ongoing maintenance of cybersecurity controls aligned with NIST Special Publication 800-171 to safeguard covered defense information, as mandated by DFARS 252.204-7012. This includes establishing and enforcing technical, administrative, and physical safeguards across all systems and environments handling sensitive defense data, ensuring compliance with all 110 security requirements outlined in the NIST framework. Continuous monitoring, risk assessments, and timely remediation of vulnerabilities are essential to maintaining compliance throughout the contract lifecycle. The contractor must promptly report any cyber incidents involving covered defense information to the Department of Defense through the designated DoD cyber incident reporting system. The obligation to report applies regardless of whether the incident results in data loss or system compromise, and includes all relevant details such as the nature of the attack, affected systems, and potential scope of impact. The contract is a subcontract under NAICS code 541512, with performance located in New Cumberland, Pennsylvania, and is issued by the Department of Defense’s DDSP New Cumberland Facility. Responses must be submitted by August 6, 2026, to ensure eligibility for award.