DFARS 252.204-7012 Cybersecurity Compliance and Incident Reporting

The contract requires the provision of comprehensive cybersecurity services to protect covered defense information in accordance with the Defense Federal Acquisition Regulation Supplement clause 252.204-7012 and the National Institute of Standards and Technology Special Publication 800-171. The contractor must implement a robust security framework that meets all specified controls for safeguarding controlled unclassified information within nonfederal systems, including access control, audit, configuration management, and incident response protocols. Compliance is mandatory and will be subject to ongoing evaluation to ensure alignment with federal cybersecurity standards. In addition to securing information systems, the contractor is obligated to promptly detect, report, and respond to any cyber incidents affecting covered defense information. Reporting timelines and content must adhere strictly to DFARS requirements, ensuring timely notification to the appropriate government authorities. The work will be performed at the designated place of performance in New Cumberland, Pennsylvania, with performance governed by the NAICS code 541512 for custom computer programming services. The subcontract is open for response until July 24, 2026, and is issued under the Department of Defense, Land Supply Chain, with all activities tied to securing critical defense data within the federal supply chain.