Cybersecurity for Covered Defense Information (CDI)

The contract requires the implementation and maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) entrusted to the contractor, ensuring compliance with federal cybersecurity standards for nonfederal systems handling sensitive DoD data. All cyber incidents affecting CDI must be reported to the Department of Defense within 72 hours through the designated DoD portal, emphasizing rapid response and transparency in the event of a breach or compromise. The obligation extends to ongoing monitoring, configuration management, access control, audit logging, and other technical and administrative safeguards outlined in the NIST framework to mitigate risks and maintain the integrity of protected information. This is a subcontract under the NAICS code 541512, issued by the Active Devices Division of the Department of Defense, with performance required at the location in New Cumberland, Pennsylvania, zip code 17070-5002. The solicitation was posted on August 3, 2026, with responses due by August 14, 2026, indicating a tight turnaround for qualified entities to submit proposals. The contractor must demonstrate proven capability in meeting NIST 800-171 requirements and possess the infrastructure and procedures to comply with mandatory incident reporting timelines. Noncompliance may result in contract termination, financial penalties, or loss of eligibility for future DoD work.