Cybersecurity Compliance and CDI Safeguarding

The contract requires the implementation of all NIST SP 800-171 cybersecurity controls to ensure the protection of Covered Defense Information (CDI) handled within the scope of performance. This includes establishing and maintaining robust technical, administrative, and physical safeguards to prevent unauthorized access, disclosure, or compromise of sensitive defense data. Compliance with these controls is mandatory and must be continuously enforced throughout the contract period to meet Department of Defense requirements for information security. In addition to safeguarding CDI, the contractor is obligated to report any cyber incident affecting the system or data within 72 hours of discovery to the appropriate Department of Defense authorities. This reporting obligation applies regardless of the scale or impact of the incident and must include all relevant details as defined by DoD policy. Performance will be conducted at the specified location in Tracy, California, under a subcontract arrangement with a NAICS code of 541512, and responses must be submitted by the stated deadline to be considered for award.