Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 controls and compliance with DFARS 252.204-7012 to ensure the protection of Covered Defense Information (CDI) on information systems used by the contractor. This includes establishing robust cybersecurity measures to prevent unauthorized access, disclosure, or alteration of sensitive data, as well as defining procedures for timely reporting of any cyber incidents that may compromise CDI. The subcontractor must adhere to strict security protocols aligned with federal standards to maintain the integrity and confidentiality of defense-related information. Performance of this subcontract is centered at Joint Base Lewis McChord, Washington, with a response deadline of July 27, 2026, and the work falls under NAICS code 541512 for computer systems design services. The contracting entity is the Department of Defense through its Aviation Supply Chain ESOC Buys organization, indicating this effort supports critical defense technology infrastructure. Compliance is non-negotiable, and failure to meet NIST or DFARS requirements could result in contract termination or penalties, making adherence to reporting timelines, access controls, and incident response protocols essential for successful performance.