Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard covered defense information within the contractor’s information systems, ensuring alignment with federal cybersecurity standards for protected data. Compliance includes establishing technical, administrative, and physical safeguards to prevent unauthorized access, disclosure, or loss of sensitive information, alongside meeting mandatory cyber incident reporting obligations as outlined in the Defense Federal Acquisition Regulation Supplement. The work is performance-based and must be executed at Hill Air Force Base, Utah, with all activities tied directly to supporting Department of Defense operations. This is a subcontract under the NAICS code 541512 for computer systems design services, solicited by the ASC Commodities Division of the Department of Defense. Proposals must be submitted by July 28, 2026, with no set-aside provisions specified. The contract demands continuous monitoring and documentation of control effectiveness, regular assessment of security posture, and timely reporting of any cyber incidents affecting covered defense information. Failure to maintain compliance may result in contract termination or financial penalties, emphasizing the critical nature of sustained adherence to NIST SP 800-171 requirements throughout the performance period.