Cybersecurity for Covered Defense Information (CDI)

The contract requires implementation of NIST SP 800-171 controls to safeguard covered defense information, ensuring compliance with federal cybersecurity standards for nonfederal systems handling sensitive DoD data. Contractors must establish and maintain robust security measures aligned with the NIST framework to protect the confidentiality, integrity, and availability of covered defense information throughout its lifecycle. Full adherence to all 110 controls outlined in the publication is mandatory, with regular assessments and documentation to demonstrate ongoing compliance. All cyber incidents involving covered defense information must be reported to the Department of Defense within 72 hours of discovery, including details on the nature, scope, and impact of the incident. The contract is structured as a subcontract under the NAICS code 541519, with performance location designated as Tracy, California, 95304-5000. Responses are due by August 3, 2026, and the solicitation is issued by the DLA Dist San Joaquin under the Department of Defense, with no specific set-aside provisions identified.