Cybersecurity Compliance for Subcontractors (CUI Handling)

This contract requires subcontractors to fully comply with DFARS 252.204-7012 and implement all mandatory controls outlined in NIST SP 800-171 when processing, storing, or transmitting Controlled Unclassified Information. Contractors must develop a System Security Plan that documents their security controls, maintain a Plan of Actions and Milestones to address any outstanding remediation items, and establish robust procedures for timely reporting of cyber incidents affecting CUI. All security measures must align with federal standards to safeguard sensitive data handled on behalf of the Department of Defense, specifically under the SPRMM1 DLA Mechanicsburg entity. Compliance is non-negotiable and applies to all systems and personnel involved in CUI handling activities under this subcontract. The solicitation opens on April 30, 2026, with responses required by May 7, 2026, at 8:00 PM Eastern Time. This is a subcontract under the NAICS code 541512 for Computer Systems Design Services, and no specific set-aside status is indicated. Performance location does not have a designated city or state, indicating potential flexibility in where the work is conducted, provided all cybersecurity requirements are met. The contract is part of the broader DoD directive to enforce stringent cybersecurity protocols across the supply chain, and failure to meet these requirements will result in non-compliance and potential termination of subcontracting privileges.