Cybersecurity for Controlled Unclassified Information (CUI)

The contract requires the implementation of NIST SP 800-171 controls and compliance with DFARS 252.204-7012 to protect Controlled Unclassified Information (CUI) across all applicable systems and processes. This includes establishing and maintaining robust cybersecurity measures to safeguard CUI from unauthorized access, disclosure, or modification, as well as ensuring continuous monitoring and documentation of security practices. All covered entities must be prepared to report any cyber incidents affecting CUI within 72 hours of discovery, following prescribed reporting procedures to ensure timely response and mitigation. The requirement is strictly tied to the handling of sensitive information within the nuclear reactor program under the Department of Defense. The contract is structured as a subcontract under NAICS code 541512 and isPerformance location is designated as Tinker Air Force Base with postal code 73145-8000. The solicitation was posted on July 23, 2026, and responses must be submitted by August 3, 2026. There is no set-aside designation specified, and the contract will be managed under the broader framework of defense cybersecurity standards. All parties must align their cybersecurity posture with federal mandates and be prepared for potential audits or assessments to validate compliance with the required controls and incident reporting obligations.