Cybersecurity & Covered Defense Information (CDI) Safeguarding

This contract mandates the implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information, ensuring compliance with federal requirements for protecting sensitive data transmitted or stored in connection with Department of Defense contracts. The contractor is obligated to establish and maintain a robust cybersecurity posture that aligns with the NIST framework, including regular assessments, access controls, audit logging, and data encryption to mitigate risks to CDI. Failure to comply with these controls may result in contract termination or penalties. In addition to protective measures, the contractor must report any cyber incidents affecting CDI within 72 hours of discovery, as stipulated under DFARS 252.204-7012. This rapid reporting requirement ensures timely government awareness and response to potential threats. The work is to be performed at a designated location in Tracy, California, with a submission deadline of August 3, 2026, and is classified as a subcontract under the NAICS code 541512 for computer systems design services. The contract is issued by the Department of Defense through the Construction & Equipment T & IFO EQ office, with no set-aside provisions applied, and is open to eligible subcontractors meeting the specified cybersecurity obligations.