Cybersecurity Compliance for Subcontractors

The contract requires subcontractors to implement the security controls outlined in NIST Special Publication 800-171 to protect Covered Defense Information handled during contracted operations. Compliance with these controls is mandatory to ensure the confidentiality, integrity, and availability of sensitive data transmitted, processed, or stored as part of subcontracted activities under the Department of Defense. Subcontractors must establish and maintain a robust cybersecurity posture aligned with federal standards, including access control, awareness training, audit and accountability, configuration management, and incident response capabilities. The performance location is designated as New Cumberland, PA, with the NAICS code 541512 indicating that the work involves custom computer programming services supporting defense systems. All subcontractors are obligated to report any cyber incidents affecting Covered Defense Information to the Department of Defense within required timeframes, as defined by DFARS clause 252.204-7012. This includes immediate notification of suspected breaches and timely submission of detailed incident reports with supporting forensic data. Failure to meet these requirements may result in contract termination or financial penalties. Responses to this solicitation must be submitted by the deadline of July 29, 2026, and the contract is structured as a subcontract under the ASC SUPPLIER OPER OEM DIVISION. All parties must operate under strict adherence to federal cyber standards with no exceptions permitted for nonperformance or partial compliance.