Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) associated with valve logistics and technical data, ensuring compliance with federal cybersecurity standards for defense subcontractors. All systems handling CDI must be configured to meet the full suite of control requirements outlined in NIST SP 800-171, including access control, awareness and training, audit and accountability, configuration management, identification and authentication, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. The contractor is also obligated to establish and maintain a robust cyber incident reporting capability to promptly detect, respond to, and report any security breaches or anomalies involving CDI in accordance with DoD directives. This subcontract falls under the NAICS code 541512 for computer systems design services and is managed by the Defense Logistics Agency under the Department of Defense. Performance of the required cybersecurity measures must be carried out on systems that process, store, or transmit CDI related to valve logistics or technical data, regardless of physical location. Compliance is mandatory and subject to ongoing assessment and verification, with failure to meet these obligations potentially resulting in contract termination or financial penalties. The contract was posted on July 20, 2026, and while no specific place of performance or point of contact is listed, the work is expected to be executed in alignment with DoD cybersecurity protocols across contractor environments.