Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract requires implementation of NIST SP 800-171 controls to safeguard Covered Defense Information (CDI) across all systems and environments handling such data. This includes establishing, maintaining, and continuously monitoring compliance with the prescribed security requirements to ensure the confidentiality, integrity, and availability of CDI. The contractor must also conduct periodic assessments to validate adherence to these controls, using approved methodologies and documentation practices aligned with Department of Defense expectations. All findings and remediation actions must be systematically tracked and reported to demonstrate ongoing compliance. Additionally, the contract mandates immediate reporting of any cyber incidents affecting CDI through the Defense Industrial Base Cybersecurity Information Sharing Platform, known as DIBNET. This includes timely notification, incident containment, forensic analysis, and submission of required reports to enable coordinated defense response and threat mitigation. Compliance with these reporting obligations is critical and non-negotiable, as failure to report incidents promptly may result in contractual penalties or loss of eligibility to handle sensitive defense information. All activities must be performed under the authority of the Naval Supply Systems Command Weapon Systems Support, with full adherence to DoD cyber policies and timelines.