Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires the implementation of NIST SP 800-171 security controls to protect Covered Defense Information and ensure compliance with the cyber incident reporting obligations mandated by DFARS 252.204-7012. The work involves establishing and maintaining a robust cybersecurity framework that meets federal standards for safeguarding sensitive defense data handled by subcontractors supporting the Department of Defense. All systems and processes handling CDI must be configured to meet the specified technical and procedural requirements under NIST 800-171, including access controls, audit logging, incident response, and data encryption. The contract is classified as a subcontract under the Defense Logistics Agency, with the North American Industry Classification System code 541512, indicating it pertains to computer systems design services. It was posted on July 21, 2026, and is tied to the contract award SPE7L126V122H, with performance expected to occur within the broader scope of DoD operations without a designated physical location specified. Compliance with the cybersecurity requirements is mandatory and non-negotiable, and failure to meet the controls or reporting obligations could result in contractual penalties, loss of eligibility for future work, or legal consequences under federal defense regulations.