Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires the implementation of NIST SP 800-171 security controls and the establishment of cyber incident reporting procedures to safeguard covered defense information across all systems and subcontractor environments. The obligations extend to ensuring that all handling, storage, and transmission of sensitive data comply with federal cybersecurity standards, with particular emphasis on protecting information that supports defense logistics and national security operations. The subcontractor must demonstrate full adherence to the NIST framework, including access control, awareness and training, audit and accountability, configuration management, identification and authentication, maintenance, media protection, personnel security, risk assessment, security assessments, system and communications protection, and system and information integrity. Any cyber incident affecting covered defense information must be reported promptly in accordance with mandated timelines and protocols. The contract is classified as a subcontract under the Department of Defense, specifically managed by the Defense Logistics Agency, with the NAICS code 541512 indicating it relates to computer systems design services. Performance is expected across all locations where covered defense information is processed or stored, with no geographic restrictions specified. Compliance is mandatory for all tiers of subcontractors involved in the work, requiring continuous monitoring, documentation, and verification of security controls. Failure to meet these requirements may result in contract termination, financial penalties, or debarment from future defense-related work. The solicitation was posted in July 2026 and is accessible through the DIBBS platform under contract number SPE7MC26V2083.