Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) handled by the contractor’s systems, in full compliance with DFARS 252.204-7012. This includes developing a System Security Plan that documents how security controls are applied, establishing procedures for timely incident reporting, and sustaining continuous monitoring of the information system to ensure ongoing compliance. All activities must align with federal cybersecurity requirements for contractors handling sensitive defense data, emphasizing proactive risk management and adherence to standardized frameworks. Performance is expected at New Cumberland, Pennsylvania, with a deadline for response set for August 13, 2026. This is a subcontract under the Department of Defense’s Land Supply Chain initiative and falls under NAICS code 541512 for computer systems design services. The contractor must be prepared to demonstrate full compliance with NIST SP 800-171 requirements, including documentation of control implementation, evidence of monitoring, and readiness for audit or assessment. Failure to meet these obligations could result in contract non-compliance penalties or loss of eligibility for future defense-related work.