Cybersecurity Compliance for Covered Defense Information

The contract requires implementation of NIST SP 800-171 controls to protect Covered Defense Information, ensuring all applicable security requirements are fully enforced across systems and processes handling sensitive data. Compliance includes conducting regular self-assessments to verify adherence to the framework and maintaining documentation to demonstrate continuous alignment with the standard. Any cyber incident involving CDI must be reported within 72 hours of discovery, with timely communication and coordinated response protocols established to meet federal defense obligations. The work is performed under a subcontract tied to the Department of Defense, specifically for the Medical Supply Chain MD Surg FSF, with performance occurring at APO, 96319-5024. The NAICS code 541612 indicates the scope involves computer systems design and related services, emphasizing the technical and procedural nature of the compliance efforts required. Responses must be submitted by May 19, 2026, with the opportunity issued on May 13, 2026, through the DIBBS platform.