Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) against unauthorized access, disclosure, or compromise. Compliance with DFARS 252.204-7012 is mandatory, which includes conducting self-assessments to evaluate the effectiveness of security controls and promptly reporting any cybersecurity incidents that affect CDI or the systems that process, store, or transmit it. The obligation extends to ensuring all technical, administrative, and physical safeguards outlined in NIST SP 800-171 are fully integrated into operations and continuously monitored for adherence. This is a subcontract under the Department of Defense with a place of performance in Bremerton, Washington, 98314-6001, and falls under NAICS code 541512 for computer systems design services. The solicitation was posted on July 5, 2026, with a response deadline of July 16, 2026. The contractor must demonstrate the capability to meet federal cybersecurity standards and sustain compliance throughout the subcontract term, with emphasis on documentation, reporting, and audit readiness. Failure to meet these requirements may result in contract penalties or termination.