Cybersecurity and Covered Defense Information (CDI) Protection

The contract requires the implementation of all NIST SP 800-171 cybersecurity controls to safeguard covered defense information, ensuring compliance with federal standards for protecting sensitive data handled by defense contractors. This includes establishing and maintaining robust security measures across systems and processes to prevent unauthorized access, data breaches, and information leakage. Contractors are obligated to promptly report any cyber incidents involving covered defense information within 72 hours of discovery, enabling timely response and mitigation by government authorities. The contract is a subcontract under the Department of Defense’s Defense Logistics Agency, classified under NAICS code 541512 for computer systems design services. It is tied to the award SPE60524D4502 and delivery order SPE60526FHRH2, with performance obligations centered on securing information systems that process or store covered defense information. The terms emphasize continuous compliance with NIST controls, incident reporting protocols, and adherence to DoD cybersecurity expectations without specifying geographic performance location or set-aside status.