Cybersecurity for Contractor Information Systems

The contract requires the implementation and maintenance of cybersecurity controls on contractor-owned information systems that process, store, or transmit Department of Energy-controlled unclassified information or federal contract information. These systems must comply with established federal cybersecurity standards to protect sensitive but unclassified data from unauthorized access, disclosure, or compromise. The scope encompasses ongoing operational security measures, continuous monitoring, and regular assessments to ensure adherence to required frameworks and to respond proactively to evolving threats. Performance of the work is centered at Upton, New York, with a deadline for proposals set for May 18, 2026. This is a subcontract under the broader DOE contract structure, categorized under NAICS code 541512, which corresponds to computer systems design services. The contractor is expected to have the technical capability to deploy, configure, and sustain cybersecurity controls tailored to protect CUI and FCI, with full accountability for compliance and risk mitigation across all relevant systems. The effort demands a proactive security posture, documentation of control effectiveness, and alignment with federal guidelines without direct oversight from the DOE, placing significant responsibility on the subcontractor for enforcement and reporting.