Cybersecurity Compliance Implementation & NIST SP 800-171 Safeguarding

The contract requires full implementation of NIST SP 800-171 security controls to protect controlled unclassified information within the system environment, ensuring alignment with both DFARS 252.204-7012 and CMMC Level 2 compliance standards. This includes developing a comprehensive System Security Plan that documents the architecture, policies, and procedures for safeguarding sensitive data, as well as conducting a thorough self-assessment to validate adherence to all applicable requirements. Immediate reporting of any cyber incidents is mandatory, with a strict 72-hour window from discovery to submission of notification to the appropriate government authorities. The work is scoped as a subcontract under the Department of Defense, with performance expected to occur at the designated location in New Cumberland, Pennsylvania. The solicitation, posted on July 20, 2026, has a tight response deadline of July 23, 2026, indicating urgency in securing a qualified vendor to meet these critical cybersecurity obligations.