Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires implementation of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) and mandates compliance with cyber incident reporting requirements as specified in DFARS 252.204-7012. All subcontractors handling CDI must establish and maintain the full suite of required security measures outlined in NIST SP 800-171, including access control, audit, configuration management, and incident response protocols, to ensure the confidentiality, integrity, and availability of sensitive defense data. Any cyber incident involving CDI must be reported promptly to the Department of Defense in accordance with the prescribed timeline and format. This subcontract is administered by the Defense Logistics Agency under the Department of Defense and falls under the NAICS code 541512 for computer systems design services. Performance location and point of contact details are not specified, but compliance is mandatory regardless of physical or virtual deployment. The solicitation is not subject to a specific set-aside category and remains open to eligible subcontractors meeting federal cybersecurity standards. The contract posting date reflects a future anticipated activation in 2026, indicating a forward-looking requirement tied to ongoing defense contracting obligations.