Cybersecurity and Covered Defense Information Safeguarding

The contract requires implementation of NIST SP 800-171 security controls to protect covered defense information, ensuring that all applicable safeguarding measures are in place and maintained throughout the performance period. Annual assessments aligned with Department of Defense requirements must be conducted to validate compliance with these cybersecurity standards, and any cyber incidents affecting covered defense information must be reported to the DoD within 72 hours of discovery. The work is classified as a subcontract under NAICS code 541512, with performance based in Melrose, Massachusetts, under the oversight of the Department of Defense’s Medical Supply Chain Pharm FSA. The solicitation is open for response until August 3, 2026, and is part of broader efforts to enforce robust cyber hygiene across the defense industrial base.