Cybersecurity Compliance & Incident Reporting

The contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 for any systems that process, store, or transmit covered defense information. This includes ensuring all required security controls are properly configured, monitored, and documented to meet federal standards for protecting sensitive defense data. The contractor must also establish and sustain an incident response capability to detect, report, and respond to cyber incidents in compliance with DFARS 252.204-7012, which mandates timely reporting of security breaches to the Department of Defense. All activities must be performed in accordance with applicable regulatory requirements and remain operational throughout the contract term. The work is to be performed at Tracy, California, with a zip code of 95304-5000, and the contract is classified as a subcontract under NAICS code 541512, indicating it relates to computer systems design services. The solicitation was posted on August 4, 2026, with responses due by August 12, 2026, and the contracting activity is under the ASC Commodities Division of the Department of Defense. The place of performance and regulatory obligations must be fully supported by the offeror, who is expected to demonstrate proven experience in securing controlled unclassified information within defense supply chain environments.