Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and thorough documentation of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) in alignment with DFARS regulatory requirements. This involves establishing robust cybersecurity practices across systems handling CDI, ensuring all controls are not only applied but also formally recorded to demonstrate adherence. Annual self-assessments must be conducted to evaluate ongoing compliance, with detailed reporting submitted to confirm that the required protections are actively maintained and effective. Performance is tied to Hill Air Force Base, with the work falling under NAICS code 541512 for computer systems design services. The contract is structured as a subcontract under the Department of Defense’s Land Supply Chain, and all activities must be completed by the response deadline of May 22, 2026. Compliance is non-negotiable and must be verifiable through documented evidence, as failure to meet NIST SP 800-171 requirements or submit timely self-assessments may result in contract non-compliance and potential penalties under DFARS clauses.