Controlled Unclassified Information (CUI) Handling and Cybersecurity Compliance

The contract requires the implementation and ongoing maintenance of cybersecurity safeguards to protect controlled unclassified information (CUI) in accordance with Defense Federal Acquisition Regulation Supplement (DFARS), NIST Special Publication 800-171, and the Cybersecurity Maturity Model Certification (CMMC) framework. The subcontractor must ensure full compliance with these standards to secure covered defense information throughout its lifecycle, including administrative, technical, and physical controls to mitigate risks associated with unauthorized access, disclosure, or compromise. The work is scoped to meet the rigor of CMMC Level 2 or equivalent requirements, emphasizing continuous monitoring, incident response, system hardening, and personnel training aligned with federal cybersecurity mandates. Performance of the contract is designated to occur at Tracy, California, with an estimated delivery and compliance timeline tied to a response deadline of August 7, 2026. The contract falls under NAICS code 541512 for computer systems design services and is issued under the Department of Defense’s Land Supplier Operations Vehicle Support organization. While no set-aside classification is specified, the subcontractor must demonstrate adequate cybersecurity infrastructure, documentation, and audit readiness, including the ability to undergo third-party assessments if required by CMMC certification. All systems and processes must be configured, tested, and maintained to ensure uninterrupted compliance with evolving federal cybersecurity obligations.