Cybersecurity Incident Reporting & Third-Party Risk Management

The contract requires the development of detailed procedures to ensure compliance with DFARS 252.204-7009, specifically focused on managing cyber incidents reported by third parties. This includes designing and implementing structured response workflows that define roles, escalation paths, and actionable steps for identifying, containing, and resolving incidents, as well as establishing strict controls for the disclosure of data during and after such events to safeguard sensitive information. The procedures must align with Department of Defense cybersecurity standards and ensure seamless integration with existing systems and protocols across the supply chain. The work under this subcontract is tied to the Medical Supply Chain MD Surg FSF under the Department of Defense and is performance-based at Quantico, Virginia, with a ZIP code of 22134-5036. The solicitation, categorized under NAICS code 541611 for management consulting services, has a tight turnaround with a response deadline of May 18, 2026, and a posting date of May 11, 2026. The contract is not subject to any set-aside provisions and is intended to strengthen the defense supply chain’s resilience against cyber threats by formalizing how third-party incident reports are handled, assessed, and responded to with accountability and precision.