Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 to safeguard covered defense information within the designated performance location in Richmond, Virginia. This includes developing a comprehensive System Security Plan that documents how all required controls are applied, monitored, and enforced to meet federal compliance standards for protecting sensitive defense data. The contractor must ensure continuous adherence to these controls throughout the contract lifecycle and establish robust processes for detecting, reporting, and responding to cyber incidents in accordance with mandatory federal reporting timelines and protocols. This subcontract, issued under the Department of Defense and classified under NAICS code 541512 for computer systems design services, is managed by the Medical Supply Chain PHSA. The solicitation closed on August 3, 2026, and the awarded contractor is expected to deliver fully compliant cybersecurity infrastructure that meets all NIST requirements without exception. Failure to implement controls properly or to report incidents in a timely manner could result in noncompliance penalties, contract termination, or loss of eligibility for future defense work. The work is performance-based with strict accountability for securing covered defense information from unauthorized access, disclosure, or compromise.