Cybersecurity Compliance (NIST SP 800-171) and Incident Reporting

The contractor is required to implement and fully document all NIST SP 800-171 security controls within systems that process, store, or transmit covered defense information, ensuring compliance with DFARS 252.204-7012. This includes developing and maintaining a System Security Plan and a Plan of Action and Milestones to address any unimplemented or incomplete controls, and performing a systematic self-assessment to validate compliance. The work must be performed at Tinker Air Force Base, Oklahoma, with all documentation and reporting procedures aligned to federal cybersecurity standards for defense contractors. The contract is structured as a subcontract under the Department of Defense, specifically managed by the ASC SUPPLIER OPER AE AND AF DIV, and falls under NAICS code 541512 for computer systems design services. All deliverables, including evidence of control implementation and assessments, must be completed and submitted by the response deadline of August 10, 2026. The contractor is also obligated to report any cybersecurity incidents involving covered defense information in accordance with the requirements of the regulation, ensuring timely communication and remediation actions are initiated without delay.