Cybersecurity for Covered Defense Information (CDI)

This contract requires the implementation of all NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) whenever the subcontractor processes, stores, or transmits technical or contract-related data on behalf of the Defense Logistics Agency. Compliance with these controls is mandatory to ensure the confidentiality, integrity, and availability of sensitive information, aligning with Department of Defense cybersecurity standards. The subcontractor must maintain continuous adherence to the framework and be prepared to demonstrate compliance at any time through audits or assessments. In addition to securing CDI, the subcontractor is obligated to report any detected cyber incidents affecting the information to the Defense Industrial Base Cybersecurity and Incident Response Portal, known as DIBNet, within a strict 72-hour window from discovery. Failure to meet this reporting requirement may result in contractual penalties or loss of eligibility to handle classified or sensitive defense data. The work is categorized under NAICS code 541512, indicating it involves computer systems design and related services, and is bound by federal cybersecurity regulations governing defense subcontractors regardless of geographic performance location.