Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires implementation of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) and ensure full compliance with DFARS cyber incident reporting obligations. All applicable safeguards must be deployed to secure CDI throughout its lifecycle, including access controls, audit logging, vulnerability management, and data encryption, with the goal of meeting federal cybersecurity standards for defense contractors. The contractor is expected to establish and maintain a robust cybersecurity posture that aligns with the requirements for handling sensitive defense data and must be prepared to promptly report any cyber incidents involving CDI in accordance with DFARS clause 252.204-7012. This is a subcontract under the Department of Defense, specifically managed by the Medical Supply Chain MD Surg FSF, with performance to occur at an FPO location with zip code 96671. The solicitation was posted on August 2, 2026, with responses due by August 10, 2026, under NAICS code 541512 for computer systems design services. Participation requires the ability to meet stringent federal cybersecurity mandates, and all systems, processes, and personnel involved must be capable of demonstrating ongoing compliance during the performance period. Failure to implement required controls or to report incidents timely may result in contractual penalties or loss of eligibility for future defense work.