Cybersecurity and Covered Defense Information Safeguarding

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information against unauthorized access, disclosure, or compromise. This includes establishing and sustaining a comprehensive cybersecurity posture aligned with federal standards, ensuring all systems handling sensitive defense data comply with required technical and procedural safeguards. The contractor must also establish an effective incident response capability capable of detecting, containing, and mitigating cyber threats in real time, with a strict requirement to report any cyber incidents to the Department of Defense within 72 hours of discovery. The work is to be performed at a designated location in San Diego, California, under a subcontract arrangement for the ASC Commodities Division of the Department of Defense. The solicitation is classified under NAICS code 541512 for Computer Systems Design Services and is open for responses until July 22, 2026. Compliance with all NIST control requirements and adherence to federal reporting timelines are mandatory, and failure to meet these obligations could result in contract termination or penalties. The contractor must be prepared to demonstrate continuous compliance through documentation, audits, and incident response exercises.