Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires full implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information across all systems and networks involved in the performance of work for the Department of Defense. This includes conducting a comprehensive system assessment to validate compliance, maintaining detailed documentation of all implemented controls and security practices, and establishing a formal incident reporting process aligned with DFARS 252.204-7012 requirements. Compliance is mandatory and must be demonstrated through verifiable evidence, with ongoing monitoring and adjustment of controls to address evolving cyber threats. The work is to be performed at Picatinny Arsenal, New Jersey, under a subcontract classified under NAICS code 541512, which pertains to computer systems design services. The response deadline is August 10, 2026, and the solicitation is issued by the ASC Commodities Division. Performance must meet all federal cybersecurity standards without exceptions, and contractors are expected to ensure end-to-end protection of sensitive information from acquisition through storage, transmission, and disposal. Any failure to meet compliance obligations could result in contract termination, financial penalties, or loss of eligibility for future defense contracts.