Cybersecurity Compliance for Contractor Systems

The contract requires the implementation of NIST SP 800-171 security safeguards on all contractor systems that handle covered defense information, ensuring that appropriate technical, administrative, and physical controls are in place to protect sensitive data. Compliance must include full adherence to the specified security requirements, ongoing monitoring of system configurations, and the maintenance of comprehensive documentation to demonstrate adherence to the standard. Contractors are also obligated to promptly report any cybersecurity incidents involving covered defense information in accordance with federal reporting protocols, and to provide evidence of corrective actions taken in response to identified vulnerabilities or breaches. The work is performed at the location in Tracy, California, with the contract classified as a subcontract under NAICS code 541512 for computer systems design services. The opportunity is issued by the Department of Defense through its ASC SUPPLIER OPER OEM DIVISION, with responses due by July 14, 2026. Participation is open without set-aside restrictions, and all interested parties must meet the NIST 800-171 compliance thresholds prior to award and maintain continuous compliance throughout contract performance. Failure to meet reporting or documentation obligations may result in contract termination or penalties under applicable federal regulations.