Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires implementation of NIST SP 800-171 security controls to protect Covered Defense Information on nonfederal systems, along with the development of a comprehensive System Security Plan that documents how these controls are applied and maintained. Compliance with DFARS 252.204-7012 mandates the identification, reporting, and handling of cyber incidents involving CDI, while adherence to DFARS 252.240-7997 ensures proper reporting of malicious code or cyber threats to the Department of Defense. All activities must be performed in alignment with federal cybersecurity requirements for contractors handling sensitive defense information, and the contractor is expected to establish robust processes for continuous monitoring, incident response, and documentation. The effort is structured as a subcontract under the Department of Defense, specifically managed by the ASC SUPPLIER OPER AE AND AF DIV, with a North American Industry Classification System code of 541512 indicating it falls under custom computer programming services. The solicitation was posted on July 14, 2026, and responses are due by July 22, 2026, indicating a narrow window for submission. The place of performance and point of contact details are unspecified, suggesting flexibility in execution location but requiring potential vendors to confirm logistical and operational alignment with DoD expectations. Participation necessitates proven experience in defense cybersecurity compliance and the ability to deliver fully documented, auditable systems meeting stringent federal standards.