Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and assessment of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) within the contractor’s systems, ensuring compliance with Department of Defense cybersecurity standards. All cyber incidents involving CDI must be reported within 72 hours of discovery, and detailed reports must be submitted to the DoD’s designated assessment database to maintain transparency and accountability. The obligation extends to full adherence to the NIST framework, including continuous monitoring and documentation of security controls to support ongoing compliance reviews. This subcontract is issued by the Fluid Handling Division under the Department of Defense, with performance required at the location in New Cumberland, Pennsylvania, ZIP code 17070-5002. It is classified under NAICS code 541512, indicating it pertains to computer systems design services. The solicitation was posted on July 14, 2026, with a response deadline of July 27, 2026, and all submissions must be made through the official DIBBS platform. Contractors must be prepared to demonstrate full capability in executing and validating cybersecurity measures, with failure to meet reporting timelines or control requirements potentially impacting contract standing.