Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract mandates that all subcontractors handling contract data implement the cybersecurity controls outlined in NIST SP 800-171 to safeguard Covered Defense Information, ensuring robust protection against unauthorized access, disclosure, or compromise. Compliance with these controls is non-negotiable and applies to any entity involved in the performance of work under this agreement, regardless of tier or scope. Subcontractors are required to establish and maintain systems, policies, and training programs that align with the standard's requirements for protecting sensitive information throughout its lifecycle. In addition to safeguarding measures, subcontractors must report any suspected or confirmed cyber incidents involving contract data within 72 hours of discovery. This rapid reporting obligation ensures timely response and mitigation across the defense supply chain and is tied directly to the integrity and security of the overall program. The contract applies to work performed under the Maritime Supply Chain division of the Department of Defense, with performance located at FPO, 09570, and is governed by NAICS code 541512. All interested parties must submit responses by the deadline of August 3, 2026, to be considered for inclusion as a subcontractor under this cybersecurity-critical agreement.