Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires the implementation and documentation of NIST SP 800-171 security controls to protect covered defense information within the designated system environment. All applicable controls must be fully configured, validated, and recorded to ensure compliance with federal cybersecurity standards for safeguarding sensitive government data. The contractor is obligated to conduct system assessments to verify control effectiveness and must establish and maintain procedures for prompt reporting of any cyber incidents affecting the information systems handling covered defense information, in strict alignment with DFARS requirements. Performance is to be carried out at Tinker Air Force Base, Oklahoma, where the contractor will integrate the required cybersecurity measures into existing infrastructure while ensuring continuous operational readiness. The work is classified as a subcontract under NAICS code 541611, indicating a focus on computer systems design services, and must be completed by the response deadline of August 13, 2026. Compliance is mandatory and subject to Department of Defense oversight, with failure to meet obligations potentially resulting in contract termination or other enforcement actions. All documentation, assessments, and incident reports must be accurate, up to date, and available for audit at any time.