Cybersecurity & Covered Defense Information Compliance (CDI)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls across systems that process, store, or transmit covered defense information, specifically related to order processing and logistics tracking functions. Compliance with these controls is mandatory to safeguard sensitive data associated with Department of Defense operations, and the contractor must ensure all technical, administrative, and physical safeguards are properly configured, monitored, and updated to meet federal cybersecurity standards. The system must be capable of continuous compliance assessment and documentation to demonstrate adherence to the framework throughout the contract lifecycle. In addition to implementing the required controls, the contractor is obligated to report any cyber incident affecting covered defense information within 72 hours of discovery, ensuring timely notification and coordinated response to potential threats. This requirement underscores the urgency of incident detection, analysis, and reporting protocols to mitigate risks to national defense data. The contract is classified as a subcontract under NAICS code 541512 and is tied to operations at Fort Bragg, North Carolina, with performance expected to support the Medical Supply Chain MD Surg FSF under the Department of Defense. Responses are due by August 5, 2026, following a posting date of July 30, 2026.