Cybersecurity Compliance and CDI Protection

The contract requires implementation and maintenance of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) against unauthorized access, disclosure, or compromise. All processes and systems handling CDI must be aligned with the full suite of security requirements outlined in NIST SP 800-171, ensuring robust cybersecurity posture across the organization. Immediate reporting of any cyber incident affecting CDI is mandatory, with a strict 72-hour window from discovery to notification, ensuring timely response and mitigation in line with Department of Defense expectations. This is a small business set-aside subcontract under NAICS code 541512, awarded by the Maritime Supply Chain office within the Department of Defense. Responses are due by July 30, 2026, and performance is expected to occur at Tracy, California, with a zip code of 95304-5000. The solicitation emphasizes compliance rigor, accountability, and operational readiness, targeting qualified small businesses capable of meeting federal cybersecurity standards for defense-related information systems.