Subcontractor Cybersecurity Flow-Down Management

The contract requires comprehensive coordination and enforcement of cybersecurity compliance standards, specifically NIST 800-171 and DFARS 7012, across all subcontractors and suppliers within the defense supply chain. The primary objective is to ensure that every tier of the supply chain adheres to mandated cybersecurity controls designed to protect Controlled Unclassified Information (CUI) and maintain the integrity of sensitive defense data. This includes implementing procedures for assessing, monitoring, and verifying compliance throughout the lifecycle of subcontractor engagements, as well as establishing clear communication channels for reporting incidents, vulnerabilities, and remediation efforts in alignment with federal requirements. The work is tied to the Nuclear Reactor Program under the Department of Defense and is performance-based in Bremerton, Washington, with a ZIP code of 98314-6001. The solicitation, posted on May 8, 2026, requires responses by May 19, 2026, and falls under the NAICS code 541611 for Management Consulting Services. The contract emphasizes the flow-down of cybersecurity obligations from prime contractors to subcontractors, ensuring consistent application of safeguards regardless of subcontractor size or location. Failure to comply may result in contractual penalties and potential disqualification from future defense work.