Cybersecurity for Controlled Unclassified Information

The contract requires implementation of NIST SP 800-171 security controls across all subcontractor IT systems that handle unclassified controlled technical information to ensure the protection of sensitive data. Compliance with these controls is mandatory and applies to any subcontractor involved in the contract, regardless of size or tier, and encompasses all aspects of information systems processing, storing, or transmitting contract-related data. In addition to securing information, subcontractors must establish and maintain processes to detect, report, and respond to cyber incidents, with a strict requirement to notify the appropriate authorities within 72 hours of identifying a potential breach or anomaly. The contract is issued under the Department of Defense’s Land Supply Chain and is categorized under NAICS code 541512, indicating a focus on computer systems design services. The place of performance is designated as New Cumberland, PA, and while the solicitation number is not provided, the official posting link is available for reference. Subcontractors must submit their responses by the deadline of July 27, 2026, and the contract type is explicitly listed as a subcontract, meaning it applies downstream to entities supporting the prime contractor. Failure to meet the cybersecurity requirements or delay in incident reporting may result in noncompliance, termination, or other contractual remedies.