Cybersecurity and Covered Defense Information (CDI) Safeguarding

This contract requires the implementation and assessment of NIST SP 800-171 controls to safeguard covered defense information against unauthorized access, disclosure, or compromise. The work must ensure full compliance with Department of Defense cyber incident reporting requirements, including timely detection, documentation, and submission of incidents involving protected data. The contractor is expected to assess current cybersecurity posture, identify gaps in control implementation, and execute a remediation plan aligned with NIST standards to achieve and maintain compliance. All activities must be performed at the designated place of performance in Williamsburg, Virginia, with deliverables centered on verifiable control adherence and incident response readiness. The contract is structured as a subcontract under NAICS code 541512, which corresponds to computer systems design services, indicating the technical nature of the work. It is issued by the Department of Defense through the Medical Supply Chain MD Surg FSF and has a response deadline of July 20, 2026, with the solicitation posted on July 12, 2026. There is no set-aside designation specified, meaning eligibility is not restricted to specific categories such as small businesses or veteran-owned firms. The contractor must be prepared to demonstrate expertise in federal cybersecurity frameworks, particularly those governing defense information systems and the handling of sensitive but unclassified data in support of DoD operational requirements.