Cybersecurity Compliance and CDI Handling

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard covered defense information generated during contract performance and reporting. This includes establishing, validating, and continuously monitoring technical, administrative, and physical safeguards to ensure compliance with federal cybersecurity requirements for protecting sensitive unclassified information. The subcontractor must maintain rigorous documentation of control implementation, conduct regular assessments, and respond promptly to any security incidents involving covered defense information. This work is performed under the auspices of the Defense Logistics Agency, part of the Department of Defense, and falls under the NAICS code 541512 for computer systems design services. The contract is structured as a subcontract with no specified set-aside classification, and while the physical location of performance is not indicated, all activities must align with DLA’s cybersecurity expectations. The contract remains active through its compliance obligations, which extend beyond initial implementation to include continuous monitoring, reporting, and adaptation to evolving threats and regulatory requirements.