Cybersecurity & Covered Defense Information (CDI) Safeguarding

The contract requires the implementation of all NIST SP 800-171 security controls to safeguard covered defense information against unauthorized access, disclosure, or compromise. This includes establishing and maintaining robust cybersecurity measures such as access control, audit and accountability, configuration management, identification and authentication, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. Compliance with these controls is mandatory to ensure the protection of sensitive government data handled under this agreement. In addition to securing the information, the contractor must report any cyber incidents affecting covered defense information within 72 hours of discovery. This reporting obligation is non-negotiable and requires immediate notification to the appropriate government authorities with full details of the incident, including the nature of the breach, impacted systems, and actions taken to mitigate damage. The contract is a subcontract under the Department of Defense, tied to NAICS code 541512, with performance located at APO 09844. Responses are due by July 27, 2026, and the requirement reflects a strict enforcement posture toward cybersecurity compliance in the defense supply chain.