Cybersecurity for Covered Contractor Information Systems

This contract requires the implementation of NIST Special Publication 800-171 controls to safeguard covered defense information on contractor information systems, in full alignment with the Defense Federal Acquisition Regulation Supplement clause 252.204-7012. The successful offeror must establish and maintain a compliant cybersecurity posture that includes robust access controls, data protection, audit logging, incident response procedures, and continuous monitoring to meet federal requirements for protecting sensitive unclassified information. Compliance is mandatory for all systems handling covered defense information, and the contractor is obligated to report any cyber incidents promptly and accurately as defined by the regulation. The solicitation is structured as a subcontract under a Total Small Business Set-Aside, meaning only small businesses certified by the Small Business Administration are eligible to respond. It falls under NAICS code 541512 for computer systems design services, indicating the work involves technical implementation and integration of cybersecurity controls. The offer deadline is August 19, 2026, and the performance location is not specified, though the contracting activity is under the Maritime Supply Chain organization within the Department of Defense. The contract emphasizes secure handling of defense-related data and demands documented evidence of NIST controls application across the entire covered information system environment.