Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation and assessment of NIST Special Publication 800-171 controls to protect covered defense information, ensuring that all security requirements are fully integrated into the contractor’s systems and processes. This includes conducting a thorough self-assessment of compliance with each control, documenting evidence of implementation, and preparing formal compliance documentation to demonstrate adherence to federal cybersecurity standards for safeguarding sensitive defense data. The work is scoped as a subcontract under the Department of Defense and is tied to the Medical Supply Chain MD Surg FSF, with performance expected to occur at Fort Lewis, Washington, 98433-9500. The North American Industry Classification System code 541512 indicates this involves computer systems design and related services, emphasizing the technical nature of the cybersecurity implementation required. Proposals must be submitted by May 6, 2026, with the solicitation posted on April 30, 2026, leaving a limited window for interested parties to prepare and respond. The contract does not specify any set-aside status or small business preferences, opening the opportunity to all qualified entities. While no point of contact is listed, the official solicitation can be accessed via the DIBBS platform using the provided link. Compliance with NIST SP 800-171 is mandatory, and failure to meet the required controls or provide verifiable documentation could result in rejection of the proposal or subsequent contract non-compliance penalties. Contractors must have proven experience in executing NIST frameworks and be prepared to undergo rigorous assessment of their cybersecurity posture as part of the award process.