Cybersecurity Compliance and CDI Safeguarding

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard covered defense information, ensuring that all applicable requirements for protecting sensitive data are met throughout the contract lifecycle. This includes establishing robust cyber hygiene practices, access controls, audit logging, and data encryption measures aligned with NIST standards to mitigate risks associated with unauthorized access, disclosure, or compromise of covered defense information. The contractor must also prepare for and execute a self-assessment toward CMMC Level 2 certification, demonstrating compliance through documented policies, procedures, and technical implementations that meet the required maturity level for handling federal contract information. Additionally, the contractor is obligated to maintain a responsive cyber incident reporting capability, ensuring that any confirmed or suspected cyber incidents involving covered defense information are reported to the appropriate government authorities within 72 hours of discovery. The work is governed under the Department of Defense and falls under the NAICS code 541512 for computer systems design services, with performance expected under a subcontract arrangement. The solicitation was posted in July 2026 with bids due in early August 2026, and all activities must align with the defense supply chain’s cybersecurity expectations as coordinated by the Maritime Supply Chain organization.