Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) against unauthorized access, disclosure, or compromise, ensuring full compliance with federal cybersecurity standards for defense contractors. All systems handling CDI must be configured and maintained to meet the specific technical and procedural requirements outlined in NIST SP 800-171, including access control, audit logging, configuration management, and incident response protocols. A critical obligation is the mandatory reporting of any cyber incident affecting CDI within 72 hours of detection, with precise documentation and escalation procedures to be followed without delay. This is a subcontract under the Department of Defense, issued by the DLA Fleet Readiness Center DLA PSC, with performance location specified as Cherry Point, North Carolina, zip code 28533-0021. It falls under NAICS code 541512 for Computer Systems Design Services, indicating the expected scope involves technical implementation and configuration services rather than general consulting. The solicitation was posted on July 26, 2026, with responses due by August 3, 2026, and the opportunity is accessible through the DIBBS platform. Contractors must be prepared to demonstrate full adherence to NIST controls and maintain readiness for immediate incident reporting as a condition of award and ongoing performance.