Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 to safeguard covered defense information on all systems that process, store, or transmit contract-related data. This obligation applies to subcontractors supporting the Defense Logistics Agency under the Department of Defense and encompasses comprehensive measures to ensure the confidentiality, integrity, and availability of sensitive information throughout the system lifecycle. The work is scoped to meet federal requirements without reliance on additional set-aside classifications and must be sustained continuously to remain compliant. The performance of this subcontract is tied to the federal acquisition environment, with no specified geographic restriction on where the work may be conducted, though all systems handling covered defense information must reside within environments that fully adhere to the NIST standard. The subcontractor is responsible for self-assessing and documenting compliance, responding to security incidents, and maintaining audit-ready records to verify ongoing control effectiveness. Failure to meet these requirements may result in contractual repercussions, including termination or financial penalties, given the critical nature of protecting defense-related data across the supply chain.