Cybersecurity Compliance for Covered Defense Information (CDI)

This contract requires subcontractors handling Covered Defense Information (CDI) during logistics or reporting activities to fully implement the cybersecurity controls outlined in NIST SP 800-171 and establish robust cyber incident reporting procedures as mandated by DFARS 252.204-7012. Compliance is non-negotiable and applies to any entity accessing, processing, or transmitting CDI in support of Department of Defense obligations, with the place of performance located in Tracy, California, under the NAICS code 541512 for other computer-related services. All subcontractors must demonstrate adherence to the specified security requirements through documented policies, technical configurations, and incident response capabilities that meet federal defense standards. The solicitation is open until August 3, 2026, and is issued under the Department of Defense’s Construction & Equipment T & IFO EQ office, targeting subcontractors who will interface with sensitive defense data as part of logistics operations. Failure to meet the NIST SP 800-171 controls or delays in reporting cyber incidents will result in non-compliance and potential contract termination. Participation requires a clear understanding of CDI definitions, proper safeguarding of information systems, and the ability to report incidents to the DoD within stipulated timeframes, ensuring continuous protection of critical defense information throughout the supply chain.