Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls across all IT systems that process, store, or transmit covered defense information, ensuring compliance with federal cybersecurity standards for protected data. This includes establishing technical, administrative, and physical safeguards to protect the confidentiality, integrity, and availability of sensitive information, as well as establishing robust procedures for detecting, reporting, and responding to cyber incidents in accordance with mandatory federal timelines and protocols. The subcontractor must maintain continuous compliance, conduct regular assessments, and support audits or inspections related to the security controls. The work is performed under a subcontract awarded by the Defense Logistics Agency, part of the Department of Defense, with the NAICS code 541512 indicating it falls under custom computer programming services. The contract is set to be active beginning July 31, 2026, and the place of performance is not specified, meaning work may occur at any location authorized by the prime contractor or the government, provided all security requirements are met. The subcontractor is responsible for ensuring all system environments and personnel handling covered defense information adhere strictly to the NIST framework and are prepared for immediate incident reporting to the appropriate DOD authorities upon detection of any cybersecurity breach or anomaly.