Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and ongoing maintenance of NIST Special Publication 800-171 controls to safeguard Covered Defense Information (CDI) held by the contractor. This includes establishing and sustaining security measures aligned with the NIST framework across all applicable systems and environments, ensuring that CDI is protected from unauthorized access, disclosure, or compromise at all times. Annual self-assessments must be conducted to evaluate compliance with each control, and any detected security incidents involving CDI must be reported promptly in accordance with federal requirements. Comprehensive documentation of all compliance activities, including policies, procedures, training records, and assessment results, must be maintained and made available upon request. This is a subcontract under the Department of Defense, specifically tied to the Aviation Supply Chain ESOC Buys initiative, with the NAICS code 541512 indicating it relates to computer systems design services. Compliance is not optional and failure to meet the NIST SP 800-171 requirements could lead to contract termination or other penalties. The solicitation was posted on July 26, 2026, with responses due by August 3, 2026, emphasizing a tight turnaround for potential subcontractors seeking to meet these cybersecurity obligations. The place of performance and point of contact are unspecified, suggesting flexibility in execution but requiring bidders to confirm operational details directly with the awarding entity.