Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires implementation of NIST SP 800-171 security controls to protect covered defense information and mandates compliance with cyber incident reporting requirements under DFARS 252.204-7012. This subcontract is issued by the Defense Logistics Agency under the Department of Defense and applies to any entity handling covered defense information, necessitating robust cybersecurity practices aligned with federal standards. All covered systems must be configured to meet the specified security requirements, and any cyber incidents involving the compromise or potential exposure of covered defense information must be reported promptly in accordance with the DFARS clause. The NAICS code 541512 indicates the work involves computer systems design and related services, suggesting the subcontractor will provide technical solutions or services that process or store covered defense information. The contract does not specify a place of performance or point of contact, and it is posted for potential award in 2026. Compliance with these cybersecurity obligations is a condition of contract award and continued performance, with failure to meet requirements potentially resulting in contract termination or penalties. The subcontractor is responsible for maintaining documentation of control implementation and ensuring ongoing adherence to the required frameworks.