Cybersecurity Compliance for Subcontractors Handling CDI

This contract requires subcontractors to provide IT or engineering services that involve handling Covered Defense Information, with strict adherence to NIST SP 800-171 cybersecurity requirements. All parties must implement the full set of security controls outlined in the standard to protect sensitive defense data throughout the lifecycle of the services performed. Compliance is mandatory and subject to verification, with no deviations or exceptions permitted. Any security incident involving the compromise, loss, or unauthorized access to Covered Defense Information must be reported promptly according to established federal guidelines, ensuring timely response and mitigation. The work is performed under a subcontract issued by the Defense Logistics Agency within the Department of Defense, categorized under NAICS code 541512 for computer systems design and related services. The contract does not specify a geographic location for performance, nor does it include set-aside provisions, meaning it is open to all qualified subcontractors regardless of size or status. The solicitation was posted in July 2026, and full compliance with the cybersecurity framework is a condition of contract award and continued performance, with failure to meet requirements potentially resulting in termination or penalties.