Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires the implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) handled under the agreement, ensuring compliance with the cybersecurity standards mandated for DoD subcontractors. All systems and processes must be configured to meet the full scope of NIST controls relevant to protecting CDI, including access control, audit and accountability, configuration management, and incident response procedures. A critical requirement is the obligation to report any cyber incident affecting CDI within 72 hours of discovery, in strict accordance with DFARS clause 252.204-7012, which includes notifying the DoD and preserving forensic data for potential investigation. The contract is classified as a subcontract under NAICS code 541512, indicating it relates to computer systems design services, and is issued by the Department of Defense through the Medical Supply Chain MD Surg FSF office. Performance is mandated to occur at the facility located in Groton, Connecticut, with a ZIP code of 06340-4905. The solicitation was posted on August 9, 2026, and responses are due by August 17, 2026. The contract is not subject to any specific set-aside provisions, and while the point of contact details are not provided, the official solicitation can be accessed via the DIBBS platform under reference number SPE2DS26T324N. Compliance with these requirements is non-negotiable for contract award and continued performance.