Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and maintenance of NIST SP 800-171 controls to protect Covered Defense Information (CDI), with a focus on access control, incident reporting, and achieving SPRS readiness. This subcontract mandates strict adherence to cybersecurity standards designed to safeguard sensitive defense data from unauthorized access, disclosure, or compromise. Performance must align with the technical and procedural requirements of NIST SP 800-171, ensuring continuous compliance throughout the contract lifecycle, including prompt reporting of any security incidents and ongoing preparation for SPRS assessments. The work is associated with the Department of Defense, specifically under the ASC Commodities Division, and the place of performance is located in New Cumberland, Pennsylvania, with a ZIP code of 17070-5002. The solicitation was posted on August 5, 2026, and responses are due by August 13, 2026. The NAICS code 541512 indicates this is for computer systems design services, reflecting the nature of the cybersecurity implementation and support needed. This subcontract is open to qualified vendors capable of meeting federal cybersecurity obligations without specific set-aside restrictions.