Cybersecurity & Covered Defense Information (CDI) Protection

The contract requires the implementation of NIST SP 800-171 controls to safeguard Covered Defense Information (CDI) throughout all systems and processes involved in the performance of work under the agreement. This includes establishing and maintaining robust cybersecurity practices that align with federal standards for protecting sensitive unclassified information related to defense contracts. Compliance with these controls is mandatory and must be continuously validated to ensure the integrity, confidentiality, and availability of CDI at all times. In addition to the control implementation, the contract mandates timely reporting of any cybersecurity incident affecting CDI to the Defense Cyber Crime Center (DC3) within a strict 72-hour window of discovery. This reporting requirement is non-negotiable and applies to all incidents regardless of scope or impact, ensuring the Department of Defense maintains situational awareness and can respond swiftly to potential threats. The subcontract falls under NAICS code 541512 and is administered by the Defense Logistics Agency, with performance obligations tied to DoD cybersecurity policy and incident response protocols.