Cybersecurity and Covered Defense Information Safeguarding

This contract requires the implementation of NIST SP 800-171 controls and compliance with DFARS 252.204-7012 to ensure the protection of covered defense information within contractor information systems. The scope centers on establishing and maintaining robust cybersecurity measures to safeguard sensitive data handled by the subcontractor, aligning with Department of Defense standards for information security. Performance is expected to occur at Joint Base Andrews, Maryland, with the work falling under NAICS code 541512, indicating it involves computer systems design and related services. The solicitation is categorized as a subcontract with a response deadline of July 27, 2026, and was posted on July 21, 2026. The contracting activity is under the Medical Supply Chain MD Surg FSF, a division within the Department of Defense. Compliance with all specified cybersecurity requirements is mandatory, and failure to implement the required controls could jeopardize contract performance and eligibility for future work. The subcontractor must be prepared to demonstrate adherence to the NIST and DFARS frameworks throughout the performance period, with attention to incident reporting, access control, audit logging, and data encryption as defined in the regulatory guidance.