Cybersecurity Compliance (NIST SP 800-171)

The contract mandates strict adherence to NIST SP 800-171 and DFARS 252.204-7012 for all systems processing covered defense information, requiring the implementation of comprehensive cybersecurity controls and the development of a System Security Plan to document compliance measures. Contractors must establish robust procedures for identifying, reporting, and responding to cybersecurity incidents involving covered defense information, ensuring timely communication with the government in accordance with regulatory requirements. The obligation extends to maintaining ongoing compliance through continuous monitoring, documentation, and audit readiness. This subcontract, issued under NAICS code 541512 by the Department of Defense’s ASC Commodities Division, is performance-based and requires execution at the specified location in New Cumberland, Pennsylvania, with a response deadline of May 20, 2026. While no set-aside designation is specified, the contract emphasizes the critical nature of securing sensitive defense data and expects full alignment with federal cybersecurity standards. All parties must ensure their systems, personnel, and processes are fully capable of meeting the technical and procedural demands of NIST and DFARS compliance without exception.