Cybersecurity Compliance for Covered Systems

The contract requires the implementation of NIST SP 800-171 security controls and compliance with DFARS 252.204-7012 to protect controlled unclassified information on contractor systems supporting the Nuclear Reactor Program under the Department of Defense. The work is centered on ensuring robust cybersecurity measures are integrated into all covered systems to meet federal standards for safeguarding sensitive data, with performance obligations tied to Tinker AFB, Oklahoma, and a response deadline of August 6, 2026. This subcontract falls under NAICS code 541512, indicating it involves computer systems design and related services, and is part of a broader effort to enforce cybersecurity posture across the defense industrial base. All parties must adhere strictly to the specified controls for access, identification, authentication, audit, configuration management, incident response, and system integrity, with no flexibility allowed in meeting the mandatory requirements. The contract demands full documentation of compliance efforts, continuous monitoring, and readiness for assessments to validate adherence to NIST and DFARS criteria. The work must be completed within the performance boundaries defined by the place of performance, and all systems handling CUI must be secured to prevent unauthorized access, disclosure, or modification throughout the lifecycle of the contract.