Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) and ensure full compliance with the Defense Federal Acquisition Regulation Supplement (DFARS) for systems that process, store, or transmit contract-related data. This effort is critical for protecting Covered Defense Information (CDI) and must be executed across all applicable systems within the scope of the subcontract, with continuous monitoring and documentation to demonstrate adherence to federal cybersecurity standards. The contractor must align security practices with the latest NIST guidelines and maintain audit-ready records to support compliance assessments throughout the contract term. The work is associated with the Department of Defense under the Medical Supply Chain MD Surg FSF agency, with performance located at FPO, ZIP 96691, and is classified as a subcontract under NAICS code 541611. Responses are due by May 18, 2026, following a solicitation posted on May 11, 2026. While specific point of contact details are not provided, bidders must ensure their compliance approach is comprehensive, covering all 110 controls outlined in NIST SP 800-171, including access control, audit and accountability, configuration management, and incident response, to meet DoD requirements for securing sensitive defense information.