Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) and ensure full compliance with DFARS 252.204-7012, focusing on the protection of Covered Defense Information (CDI). This includes establishing robust cybersecurity measures to defend against threats, conducting regular assessments of control effectiveness, and maintaining documented evidence of compliance. All systems handling CUI must meet the specified technical and procedural requirements outlined in the NIST framework, with particular attention to access control, audit and accountability, configuration management, and incident response protocols. In addition to control implementation, the contractor is obligated to report any cyber incidents affecting CUI or CDI within seven business days of discovery, providing detailed documentation of the incident, its impact, and remediation efforts. The work is governed under a subcontract arrangement with a place of performance in New Cumberland, Pennsylvania, 17070-5002, and falls under NAICS code 541512 for computer systems design services. Responses must be submitted by August 20, 2026, with the solicitation initiated by the Department of Defense’s DDSP New Cumberland Facility, emphasizing the critical need for secure information handling within the defense industrial base.