Cybersecurity Compliance & NIST SP 800-171 Implementation

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information, ensuring all systems and processes meet federal cybersecurity standards for handling sensitive defense data. The contractor must conduct regular self-assessments to verify compliance with each control and maintain documentation to demonstrate adherence. Any cyber incident affecting CDI must be reported to the appropriate government authorities within 72 hours of discovery, with no exceptions or delays permitted. The work is to be performed at the specified location in Tracy, California, under a subcontract arrangement governed by the Department of Defense’s ASC Commodities Division, with the NAICS code 541512 indicating it pertains to computer systems design services. Proposals must be submitted by the specified deadline to be considered, and failure to meet the stated compliance and reporting requirements may result in contract termination or penalties.