Cybersecurity Compliance (NIST SP 800-171) Assessment & Reporting

The contract requires the implementation, assessment, and documentation of cybersecurity controls to safeguard covered defense information in full compliance with NIST SP 800-171 and DFARS 252.204-7012. This includes establishing robust security measures aligned with the NIST framework, conducting thorough assessments to verify control effectiveness, and maintaining detailed documentation to demonstrate adherence. Cyber incident reporting is a mandatory component, necessitating timely identification, response, and notification of any breaches or suspicious activities involving controlled unclassified information. The work is governed as a subcontract under the Department of Defense’s Nuclear Reactor Program and is performance-driven with a specified place of performance in New Cumberland, Pennsylvania, under NAICS code 541512 for computer systems design services. All activities must be completed by the response deadline of July 27, 2026, ensuring alignment with federal standards for protecting sensitive defense data.