Cybersecurity Compliance & CUI Safeguarding

The contract requires full implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within the contractor’s systems, alongside the development of a comprehensive System Security Plan that documents policies, procedures, and control applicability. The contractor must perform a Self-Assessment using the Supplier Performance Risk System (SPRS) to evaluate compliance posture and submit the resulting score as part of contractual obligations. Additionally, the contractor is mandated to establish and maintain processes for reporting cyber incidents in strict accordance with DFARS 252.204-7012, ensuring timely notification and cooperation with federal authorities during any security event. These requirements are tied to performance at the designated location in Tracy, California, with the work conducted under a subcontract awarded by the Department of Defense through DLA Dist San Joaquin. All deliverables must be completed prior to the response deadline of August 17, 2026, to meet compliance standards for handling sensitive government information.