Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and maintenance of NIST SP 800-171 security controls to safeguard covered defense information within systems that handle proposal, technical, or shipping data. This obligation applies to all subcontractors involved in supporting Maritime Supply Chain operations under the Department of Defense, ensuring that sensitive information is protected against unauthorized access, disclosure, or compromise. Compliance is mandatory and must be sustained throughout the lifecycle of the contract, with continuous monitoring and documentation to validate control effectiveness. Performance is centered at New Cumberland, Pennsylvania, with a response deadline of July 6, 2026, and the solicitation falls under NAICS code 541512 for computer systems design services. This is a subcontract under the Department of Defense’s broader cybersecurity framework, and adherence to NIST controls is non-negotiable for eligibility and contract fulfillment. All systems must be configured to meet the specified standards and maintain audit readiness, with enforcement tied to ongoing operational responsibilities rather than a one-time certification. Failure to comply may result in contract termination or loss of access to protected data.