Cybersecurity Compliance (NIST SP 800-171) and Reporting

The contract requires full implementation of NIST SP 800-171 cybersecurity controls to protect covered defense information and ensure compliance with Department of Defense standards. All applicable security requirements outlined in the NIST publication must be systematically applied across systems handling sensitive government data, with ongoing monitoring and documentation to validate adherence. A formal self-assessment must be completed and submitted to verify the effectiveness of implemented controls, and any cyber incident affecting covered systems must be reported to the appropriate government authority no later than 72 hours after detection, as mandated by DFARS clauses. The performance location is specified as New Cumberland, Pennsylvania, with the NAICS code 541512 indicating this is a subcontract for computer systems design services. The effort is under the jurisdiction of the Fluid Handling Division within the Department of Defense and must be responded to by August 3, 2026.