Cybersecurity Compliance and CDI Safeguarding

The contract requires implementation and maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information, ensuring compliance with federal cybersecurity standards for contractors handling sensitive defense data. The contractor must establish a robust security posture aligned with the requirements of NIST Special Publication 800-171, including continuous monitoring, access control, configuration management, and incident response capabilities. Self-attestation of compliance is mandatory, demonstrating that all required controls are properly documented, configured, and enforced across all systems processing or storing Covered Defense Information. Additionally, the contractor is obligated to promptly report any cyber incidents affecting the confidentiality, integrity, or availability of such information, in accordance with mandatory reporting timelines and procedures established by the Department of Defense. This subcontract is issued by the Defense Logistics Agency under the NAICS code 541512, with performance expected to occur at March Air Reserve Base, California, 92518-1748. The solicitation was posted on July 14, 2026, with responses due by July 27, 2026. All work must be conducted in alignment with Department of Defense cybersecurity policies, and failure to meet compliance obligations or report incidents appropriately may result in contractual penalties or loss of eligibility for future defense engagements. The contractor must maintain rigorous internal processes to ensure ongoing adherence to security requirements and be prepared to provide evidence of compliance upon request.