Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect covered defense information on contractor systems supporting manufacturing and logistics operations for the Department of Defense. All parties must ensure that their information systems comply with the full set of requirements outlined in NIST SP 800-171, including access control, audit, configuration management, maintenance, media protection, personnel security, risk assessment, system and communications protection, and incident response. Compliance is mandatory for any subcontractor handling covered defense information, and continuous monitoring and documentation of control implementation are expected throughout the contract lifecycle. The work is categorized under NAICS code 541512 for computer systems design services and falls under a subcontract agreement managed by the Defense Logistics Agency. The solicitation was posted on July 30, 2026, with a response deadline of August 10, 2026, indicating a relatively short turnaround for proposal submission. Performance of the required cybersecurity measures will occur across contractor systems wherever covered defense information is processed, stored, or transmitted, with no specific geographic limitations provided. Failure to implement or maintain these controls could result in noncompliance penalties, termination of subcontracting rights, or loss of eligibility for future DoD contracts involving sensitive information.