Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires the implementation of NIST SP 800-171 security safeguards and cyber incident reporting procedures for any systems handling Covered Defense Information (CDI), in full alignment with the mandatory requirements of DFARS 252.204-7012. The scope encompasses establishing technical, administrative, and physical controls to protect CDI from unauthorized access, use, disclosure, disruption, modification, or destruction, ensuring compliance with the full set of 110 security requirements outlined in NIST SP 800-171. Additionally, the contractor must integrate processes to detect, report, and respond to cyber incidents involving CDI within 72 hours of discovery, including providing detailed incident reports to the Department of Defense upon request, and must maintain documentation demonstrating continuous compliance with all applicable controls. The contract is structured as a subcontract under the Department of Defense’s LAND SUPPLY CHAIN organization, with performance required at the specified location in NEW CUMBERLAND, PA, 17070-5002. It falls under NAICS code 541512, indicating it is related to computer systems design and related services, and is issued with a response deadline of July 27, 2026. Compliance is non-negotiable and tied directly to the handling of sensitive defense data, making the contractor responsible for maintaining a robust, auditable cybersecurity posture at all times. Failure to meet these requirements may result in contract termination, financial penalties, or loss of eligibility for future DoD work.