Cybersecurity and Covered Defense Information (CDI) Protection

The contract requires implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information against unauthorized access, disclosure, or compromise, ensuring compliance with federal cybersecurity standards for defense contractors. All systems and processes handling such information must be configured to meet the specified control requirements, with ongoing monitoring and documentation to demonstrate adherence. Cyber incidents involving Covered Defense Information must be reported to the appropriate government authority within 72 hours of discovery, including detailed information on the nature, scope, and impact of the incident. This is a subcontract under the Department of Defense, classified under NAICS code 541330, with performance located in Tracy, California, and a response deadline of July 16, 2026. The contracting office is the Land Supply Chain within the Department of Defense, and the work is expected to align with defense cybersecurity mandates. No set-aside provisions are specified, and the contract is open to qualified subcontractors capable of meeting the NIST SP 800-171 compliance and rapid incident reporting obligations.