Cybersecurity Compliance for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Covered Defense Information (CDI) in compliance with DFARS 252.204-7012, ensuring that all applicable cybersecurity requirements are fully met. The contractor must not only deploy the mandated technical and procedural safeguards but also complete and submit a formal assessment through the DoD Supplier Performance Risk System (SPRS) to demonstrate compliance, with the assessment being accurately recorded and verified in accordance with Department of Defense standards. The work is tied directly to handling sensitive defense data and requires strict adherence to federal cybersecurity frameworks. This subcontract is associated with NAICS code 541512 and is performance-based at the location in Tracy, California, with a zip code of 95304-5000. The solicitation was posted on July 16, 2026, and responses are due by July 27, 2026, with no set-aside provisions specified. The contracting activity falls under the ACTIVE DEVICES DIVISION of the Department of Defense, indicating the scope is linked to defense-related technology or systems requiring secure data handling. Failure to achieve full compliance with NIST controls and provide a valid SPRS submission may result in contract non-fulfillment or penalties under applicable defense contracting regulations.