Cybersecurity and Covered Defense Information (CDI) Protection

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) handled by the contractor. This includes ensuring all applicable technical, administrative, and physical safeguards are properly configured, monitored, and updated to meet federal cybersecurity standards for non-classified information within the defense industrial base. The contractor must conduct regular self-assessments to verify compliance with these controls and maintain documentation to demonstrate adherence throughout the contract term. Additionally, the contractor is obligated to promptly report any cyber incidents involving CDI through the DIBNet portal within 72 hours of discovery. Failure to comply with this reporting requirement could result in contractual penalties or loss of eligibility for future defense work. The contract falls under the Department of Defense, specifically managed by the Defense Logistics Agency, and is classified as a subcontract with a NAICS code of 541512 for computer systems design services. All work must be performed in alignment with federal cybersecurity mandates and maintain the integrity and confidentiality of sensitive defense data.