Cybersecurity and Covered Defense Information (CDI) Safeguarding

The contract requires implementation of NIST SP 800-171 controls to safeguard Covered Defense Information (CDI) against unauthorized access, disclosure, or compromise, ensuring compliance with federal cybersecurity standards for defense contractors. All systems handling CDI must be configured and maintained to meet the full suite of controls outlined in the NIST publication, covering areas such as access control, audit, configuration management, incident response, and risk assessment. Timely response to cyber incidents is mandatory, with all incidents requiring detection, reporting, and mitigation within 72 hours of discovery to minimize potential damage and ensure continuity of operations. The contractor must also provide full forensic access and cooperation during any cybersecurity investigation, allowing authorized personnel to collect, preserve, and analyze digital evidence from systems containing CDI. Performance of all cybersecurity obligations is tied to the location in Tracy, California, with the work conducted under a subcontract awarded by the Department of Defense’s ASC Commodities Division. The solicitation, classified under NAICS code 541512 for Computer Systems Design Services, has a response deadline of July 29, 2026, and is open for bidding through the DIBBS platform. Compliance with these requirements is critical to maintaining eligibility for defense-related work and avoiding contract termination or penalties.