Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and ongoing maintenance of cybersecurity safeguards aligned with NIST SP 800-171 for systems that process, store, or transmit Covered Defense Information (CDI). These safeguards must ensure the confidentiality, integrity, and availability of sensitive defense data in compliance with Department of Defense requirements. A critical obligation is the reporting of any cyber incidents involving CDI to the DoD within 72 hours of discovery, necessitating robust monitoring, detection, and reporting capabilities. The work is designated as a subcontract under NAICS code 541512 and is to be performed at Fort Bliss, Texas, with a response deadline of July 28, 2026. The contracting activity falls under the Medical Supply Chain MD Surg FSF, highlighting the specialized nature of the defense information protected under this agreement.