Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract requires full compliance with NIST SP 800-171 to protect Controlled Unclassified Information as defined under Department of Defense regulations, specifically focusing on Covered Defense Information. All necessary security controls must be implemented to safeguard this information throughout its lifecycle, including administrative, physical, and technical measures aligned with NIST standards. The contractor is obligated to establish and maintain a robust cybersecurity framework that meets the stringent requirements for handling CDI, ensuring data integrity, confidentiality, and availability. In addition to implementing safeguards, the contractor must promptly detect, report, and respond to any cyber incidents affecting CDI in accordance with DFARS requirements. This includes timely notification to the appropriate government authorities and cooperation in incident response activities. The subcontract is issued under the Defense Logistics Agency, part of the Department of Defense, and falls under the NAICS code for computer systems design and related services, indicating the nature of the technical work involved. Compliance is non-negotiable and must be maintained continuously from performance initiation through contract completion.