Cybersecurity Compliance for Covered Defense Information

This contract requires the implementation of NIST SP 800-171 security controls to protect covered defense information as mandated by DFARS 252.204-7012, ensuring that all systems handling such data meet federal cybersecurity standards for non-federal entities. The contractor must establish and maintain adequate security measures to safeguard sensitive information, including access controls, audit capabilities, configuration management, and incident response protocols, while also being prepared to report any cyber incidents affecting the confidentiality, integrity, or availability of covered defense information within the specified timeframes. Compliance is mandatory and will be subject to verification and potential assessment by the Department of Defense. The contract is structured as a subcontract under the NAICS code 541512 for custom computer programming services and is issued by the Department of Defense through the Medical Supply Chain FSH office. The place of performance is designated as FPO with zip code 09591, and responses must be submitted by July 23, 2026. This engagement is not subject to any specific small business set-aside, and all interested parties must meet the full scope of NIST and DFARS requirements to be considered for award. The solicitation is accessible via the DIBBS portal, and all work must align with the Department of Defense’s cybersecurity expectations for contractors processing, storing, or transmitting covered defense information.