Cybersecurity Compliance for Covered Defense Information

This contract requires the implementation of NIST Special Publication 800-171 security controls on systems that process, store, or transmit covered defense information, ensuring compliance with federal cybersecurity standards for non-federal organizations handling sensitive Department of Defense data. The contractor must establish and maintain a robust security posture aligned with the 110 controls outlined in NIST SP 800-171, covering areas such as access control, audit and accountability, configuration management, and incident response. Additionally, the contractor is obligated to report any cyber incident affecting these systems within 72 hours of discovery, providing detailed information on the nature, scope, and impact of the incident to the appropriate government authorities. The contract is structured as a subcontract under the Department of Defense, specifically for the Aviation Supply Chain ESOC Buys division, with performance requirements tied to the location of MCAS Kaneohe Bay, Hawaii, ZIP 96863-3063. It falls under NAICS code 541512 for Computer Systems Design Services, indicating the need for technical expertise in designing and implementing secure IT environments. The solicitation opened on July 30, 2026, and responses are due by August 7, 2026, with no set-aside provisions specified, meaning competition is open to all eligible entities regardless of size or status. All work must be completed in alignment with DoD cybersecurity mandates and must support the protection of sensitive information throughout its lifecycle.