Cybersecurity Compliance for Covered Defense Information (CDI)

This contract mandates the full implementation of NIST SP 800-171 security controls across all systems that handle Covered Defense Information, ensuring robust protection of sensitive data throughout the supply chain. Compliance is not limited to the prime contractor but extends through mandatory flow-down requirements to all subcontractors, who must adhere to the same cybersecurity standards and reporting obligations. The agreement emphasizes immediate and accurate cyber incident reporting in accordance with federal regulations, requiring prompt detection, documentation, and notification of any security breaches or unauthorized access events involving CDI. The contract is issued under the Department of Defense through the Defense Logistics Agency, falls under NAICS code 541512 for computer systems design services, and is structured as a subcontract with no specific set-aside designation. Performance is expected to occur across all locations where covered systems are operated, with no geographic restrictions specified. The contract’s effective date is set for July 31, 2026, and its primary objective is to enforce a uniform, organization-wide cybersecurity posture aligned with federal defense standards, ensuring continuity of compliance from prime contractor down to every tier of subcontracted support.