Cybersecurity Compliance for Covered Defense Information (CDI)

The contractor is required to implement and maintain all NIST SP 800-171 security controls for information systems that processing, storing, or transmitting Covered Defense Information (CDI), ensuring full compliance with federal cybersecurity standards. This includes establishing robust access controls, audit logging, configuration management, incident response capabilities, and continuous monitoring to safeguard sensitive defense data. The contractor must also support timely cyber incident reporting in accordance with DFARS 252.204-7012, which mandates immediate notification of any security breaches or anomalies affecting CDI and cooperation with government investigations. All systems must be configured and operated to meet the baseline requirements outlined in NIST SP 800-171, and documentation of control implementation, risk assessments, and system security plans must be maintained and available for audit. Performance of this subcontract is centered at New Cumberland, Pennsylvania, with all cybersecurity activities required to be conducted in compliance with Department of Defense directives. The work falls under NAICS code 541512, reflecting the specialized nature of the information technology services required. The solicitation closed on July 16, 2026, and the contract is expected to support ongoing operational security for defense-related systems. Failure to meet NIST SP 800-171 requirements or delays in incident reporting could result in contract non-compliance, penalties, or loss of eligibility for future DoD work. The contractor must maintain a continuous state of readiness for audits, assessments, and potential government oversight related to CDI protection and cyber incident response.