Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 security controls and compliance with DFARS 252.204-7012 to safeguard Controlled Unclassified Information (CUI) and ensure readiness for Department of Defense assessments. The subcontractor must establish, maintain, and demonstrate a robust cybersecurity posture aligned with federal standards for protecting Covered Defense Information (CDI), including systems, networks, and processes that handle or store sensitive defense data. All technical and administrative controls must be fully documented, operational, and subject to audit or evaluation by DoD representatives to verify compliance. Performance is expected at Tinker Air Force Base with a zip code of 73145-8000, and the work falls under NAICS code 541512 for computer systems design services. The solicitation is issued by the ASC SUPPLIER OPER OEM DIVISION under the Department of Defense, with a response deadline of July 30, 2026, and a posting date of July 22, 2026. The agreement is structured as a subcontract, indicating the vendor will support a prime contractor or program responsible for defense-related systems or services. Failure to meet these requirements will result in noncompliance with federal contracting obligations and potential termination or loss of eligibility for future DoD work.