Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires full implementation of NIST SP 800-171 controls to safeguard Covered Defense Information (CDI) throughout all phases of performance, ensuring that information systems meet rigorous cybersecurity standards as defined by federal guidelines. Contractors must establish and maintain systems capable of detecting, responding to, and reporting cyber incidents within 72 hours of discovery, with clear procedures in place to notify the appropriate government authorities without delay. All cybersecurity requirements must be flowed down to any subcontractors or third-party vendors engaged in the work, ensuring compliance is enforced across the entire supply chain and no entity involved operates outside the mandated security framework. This obligation applies regardless of tier level or scope of subcontracted tasks, and failure to ensure downstream adherence constitutes a breach of contract. Performance is governed by the NAICS code 541512, indicating a focus on computer systems design and related services, with work tied to the Department of Defense through the Medical Supply Chain MD Surg FSF. The solicitation is structured as a subcontract and is open for responses until August 3, 2026, with all participants expected to align their cybersecurity posture, incident response capabilities, and subcontractor management practices to meet the stringent requirements of federal defense contracting. No set-aside provisions apply, and the obligation extends to maintaining documentation and audit readiness to demonstrate continuous compliance with NIST controls and timely reporting mechanisms for any compromise of CDI.