Cybersecurity and Data Safeguarding for CDI Handling

The contract requires implementation of all NIST SP 800-171 security controls to protect Covered Defense Information handled by subcontractors, ensuring alignment with federal cybersecurity standards for nonfederal systems. Subcontractors must establish and maintain robust safeguards to prevent unauthorized access, disclosure, or loss of sensitive defense data, and are obligated to report any cybersecurity incidents affecting such information within 72 hours of discovery. Compliance with DFARS 252.204-7012 is mandatory, requiring strict adherence to the full scope of the regulation, including documentation, system audits, and continuous monitoring. The work is to be performed at Cherry Point, North Carolina, under a subcontract solicitation issued by the Department of Defense’s DLA Fleet Readiness Center, with responses due by August 4, 2026. This contract applies to entities handling sensitive defense information and underscores non-negotiable obligations for cybersecurity posture, incident response timing, and regulatory compliance.