Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 controls to safeguard covered defense information throughout the performance of the work. This includes establishing robust cybersecurity measures to protect sensitive data from unauthorized access, use, disclosure, disruption, modification, or destruction, with a strict emphasis on compliance with federal cybersecurity standards. The contractor is responsible for ensuring all systems and processes handling covered defense information meet the specified requirements and must promptly report any cybersecurity incidents affecting such information to the appropriate authorities in accordance with mandated timelines and procedures. Additionally, the contract mandates the flowdown of these cybersecurity requirements to all subcontractors involved in the performance of work, ensuring that every tier of the supply chain adheres to the same protective standards. Subcontractors must be contractually bound to comply with NIST SP 800-171 and are subject to oversight and verification by the prime contractor. The work is being performed under a subcontract issued by the Defense Logistics Agency on behalf of the Department of Defense, with the NAICS code identifying it as related to computer systems design services, and the performance is tied to a specific contractual award referenced in the DIBBS system.