Cybersecurity Compliance for Covered Defense Information

This contract requires the implementation of cybersecurity controls outlined in NIST SP 800-171 to safeguard Covered Defense Information processed, stored, or transmitted by the contractor. Compliance with these controls is mandatory to meet the requirements of DFARS 252.204-7012, which mandates the protection of sensitive information on nonfederal systems and the timely reporting of cyber incidents affecting such systems. The contractor must establish and maintain a robust security posture aligned with the 110 security requirements specified in NIST SP 800-171, including access control, audit, configuration management, incident response, and system and communications protection measures. Cyber incidents must be reported to the Department of Defense within 72 hours of discovery, with detailed documentation provided to support investigation and remediation efforts. The contract is a subcontract under the Department of Defense, specifically managed by the Defense Logistics Agency, and falls under the NAICS code 541512 for computer systems design services. Performance is expected to occur in alignment with federal defense cybersecurity standards, though the specific place of performance is not designated. The contract was posted on July 16, 2026, and the associated award information is accessible through the DIBBS system. Failure to comply with the prescribed cybersecurity requirements or to report incidents in a timely and accurate manner may result in contract termination, financial penalties, or debarment from future defense contracts.