Cybersecurity Compliance for Covered Defense Information

This contract requires the implementation of NIST SP 800-171 controls to safeguard Controlled Unclassified Information and ensure full compliance with DFARS clauses 252.204-7012 and 252.240-7997, which govern the protection of Covered Defense Information within subcontracted services. All cybersecurity measures must align with federal standards for information system security, addressing access control, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, risk assessment, system and communications protection, and system and information integrity. The subcontract is tied to the Department of Defense under the Medical Supply Chain FSH agency, with performance obligations centered at a location in Suffolk, Virginia, with a ZIP code of 23435-5000, and the solicitation falls under NAICS code 541512 for computer systems design services. The opportunity is classified as a subcontract with no set-aside designation, and responses must be submitted by July 29, 2026, at 5:00 PM Eastern Time, following the posting date of July 22, 2026. Participation requires demonstrated capability to meet the full scope of NIST 800-171 requirements and to provide evidence of compliance with applicable DFARS provisions for handling, storing, and transmitting protected defense information. The contract is available for review and response through the DIBBS portal, and contractors must ensure their systems, policies, and personnel practices are fully aligned with the specified cybersecurity framework before bidding.