Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information and ensure compliance with DFARS 252.204-7012 and 252.240-7997 for cyber incident reporting. The work involves establishing and maintaining a secure information system environment aligned with federal cybersecurity standards, including access controls, audit logging, incident response procedures, and continuous monitoring to protect sensitive data handled under defense contracts. Compliance with these regulations is mandatory and must be fully operational by the contract performance period. The subcontract is issued under the NAICS code 541512 for computer systems design services and is associated with the Nuclear Reactor Program within the Department of Defense. Performance is required at a location in New Cumberland, Pennsylvania, with a zip code of 17070-5002. The solicitation was posted on July 30, 2026, and responses are due by August 10, 2026. The contract does not specify a set-aside classification and is administered through the DLA DIBBS portal. All awarded parties must be prepared to demonstrate full adherence to NIST controls and rapid, accurate reporting of any cyber incidents affecting Covered Defense Information in accordance with the applicable DFARS clauses.