Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) on information systems, ensuring compliance with federal cybersecurity standards for defense contractors. This includes establishing, maintaining, and regularly updating a System Security Plan that documents all security measures, roles, and responsibilities relevant to protecting CDI. The contractor must also establish and execute robust cyber incident reporting procedures, ensuring timely notification and documentation of any security breaches or anomalies affecting CDI, in alignment with DoD requirements. Performance is expected to occur at a designated location in Tracy, California, with the work classified as a subcontract under the NAICS code 541512 for computer systems design services. The solicitation was posted on August 3, 2026, and responses are due by August 14, 2026. The contracting agency is the Department of Defense through the Maritime Supply Chain organization, indicating the scope is tied to defense supply chain cybersecurity obligations. The successful offeror will be responsible for sustaining compliance through ongoing monitoring, documentation, and reporting activities to meet all regulatory and contractual security obligations.