Cybersecurity and Covered Defense Information Protection

The contract requires the implementation of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) against unauthorized access, disclosure, or compromise. All subcontractors must ensure their information systems meet the specified cybersecurity requirements outlined in the framework to safeguard sensitive defense data. Compliance is mandatory and applies to any system that processes, stores, or transmits CDI, with continuous monitoring and assessment expected to maintain control effectiveness. In addition to securing data, the contractor is obligated to report any cyber incident affecting CDI to the Department of Defense within 72 hours of discovery. This includes incidents involving data breaches, malware infections, unauthorized access, or any other cybersecurity event that may compromise the confidentiality, integrity, or availability of the information. The contract falls under the Defense Logistics Agency as part of the Department of Defense and is classified as a subcontract with a NAICS code of 541512, indicating it relates to computer systems design services. There are no set-aside provisions specified, and performance is expected to be conducted in alignment with federal cybersecurity standards without geographic restrictions.