Cybersecurity for Covered Defense Information (CDI)

The contract requires full implementation of NIST SP 800-171 security controls to protect Covered Defense Information (CDI) throughout performance, ensuring that all systems handling such data meet stringent federal cybersecurity standards. This includes the development and maintenance of a comprehensive System Security Plan that documents how the required controls are applied, monitored, and enforced. Compliance with DFARS 252.204-7012 is mandatory, mandating immediate reporting of any cyber incidents affecting CDI and cooperation with government investigations to mitigate threats and prevent further compromise. The work is performed under a subcontract with a place of performance in Mechanicsburg, Pennsylvania, 17050-2411, and falls under NAICS code 541512 for computer systems design services. The contract is administered by the Department of Defense through the Fluid Handling Division, with a response deadline of July 27, 2026. All parties must ensure that their cybersecurity posture aligns with federal requirements, maintaining continuous protection of sensitive information and demonstrating readiness to respond to incidents in accordance with Defense Federal Acquisition Regulation Supplement guidelines.