Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to protect covered defense information, ensuring full compliance with federal cybersecurity standards for contractors handling sensitive defense data. The scope includes establishing technical and administrative safeguards to prevent unauthorized access, detecting potential threats, and enforcing strict access controls across all systems that store, process, or transmit covered defense information. In addition to control implementation, the contractor must fulfill mandatory cyber incident reporting obligations, promptly notifying appropriate authorities of any security breaches or anomalies that could impact the integrity or confidentiality of the information. The contract is classified as a subcontract under NAICS code 541512 and is managed by the Department of Defense through the Medical Supply Chain Pharm FSA, with performance centered at JBER, Alaska, 99506-4400. The proposal must be submitted no later than July 27, 2026, following a posting date of July 21, 2026, indicating a narrow six-day window for responses. Although no set-aside designation is specified, compliance with NIST SP 800-171 remains non-negotiable, and failure to meet these requirements may result in contract termination or penalties. Contractors must demonstrate proven experience in applying these controls in a DoD environment and have established processes for incident response, documentation, and continuous monitoring to ensure sustained compliance.