Cybersecurity Compliance for Covered Defense Information

The contract requires implementation and maintenance of NIST SP 800-171 security controls to safeguard covered defense information throughout the performance period, ensuring strict adherence to cybersecurity standards mandated for subcontractors handling sensitive government data. Compliance must extend to all aspects of information systems supporting the contract, including technical, operational, and administrative controls aligned with the NIST framework to prevent unauthorized access, disclosure, or compromise of protected information. Any cyber incident affecting the confidentiality, integrity, or availability of covered defense information must be reported in full compliance with DFARS requirements, including timely notification and cooperation in investigative efforts. The work is to be performed at Moody AFB, Georgia, under a subcontract awarded by the Department of Defense through the Medical Supply Chain MD Surg FSF. The solicitation is classified under NAICS code 541512 for computer systems design services, indicating the scope involves technical cybersecurity implementation rather than general IT support. Proposals must be submitted by August 10, 2026, with the opportunity open to subcontractors capable of demonstrating established capability in NIST 800-171 compliance and DFARS incident reporting. There is no set-aside designation specified, meaning all eligible entities may respond, and performance is expected to meet federal defense cybersecurity obligations without deviation.