Cyber Incident Reporting and CUI Safeguarding

The contract requires the implementation of robust cybersecurity safeguards to protect Controlled Unclassified Information (CUI) processed, stored, or transmitted on covered systems, in full compliance with DFARS 252.204-7012. This includes adopting the NIST SP 800-171 security controls to ensure the confidentiality, integrity, and availability of CUI, as well as establishing procedures for the timely detection, reporting, and response to cyber incidents affecting covered defense information. All subcontractors must be able to demonstrate their ability to meet these requirements through documented policies, technical controls, and personnel training aligned with federal cybersecurity standards. This is a subcontract under the Department of Defense, specifically managed by the ASC Commodities Division, with performance required at the location in Tracy, California, zip code 95304-5000. The solicitation is open for responses until July 22, 2026, and is classified under NAICS code 541512 for computer systems design services. The contract emphasizes strict adherence to mandatory cyber incident reporting protocols, requiring immediate notification of any breach or compromise involving CUI, along with full cooperation in forensic investigations. Compliance is non-negotiable, and failure to meet these requirements may result in contractual penalties or termination.