Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and documentation of all NIST SP 800-171 security controls to safeguard Covered Defense Information and ensure full compliance with DFARS 252.204-7012. This effort is scoped to establish a robust cybersecurity framework that meets U.S. Department of Defense standards for protecting sensitive unclassified information handled by contractors. The work is structured as a subcontract under the ASC Commodities Division and must be performed at the designated place of performance in Tracy, California, with a zip code of 95304-5000. The solicitation is open for responses until August 13, 2026, and is classified under NAICS code 541512, which corresponds to Computer Systems Design and Related Services, indicating the technical nature of the cybersecurity implementation required. The contractor must deliver complete documentation demonstrating adherence to each NIST SP 800-171 control, including policies, procedures, assessment reports, and evidence of implementation across information systems handling Covered Defense Information. Compliance is non-negotiable and failure to meet these requirements may result in contract termination or loss of eligibility for future defense work. The contract is part of a broader Department of Defense initiative to enforce cybersecurity hygiene across its supply chain, and the successful bidder will be expected to maintain ongoing compliance, not just achieve it at project completion. All work must be completed under the terms and conditions outlined in the DFARS clause, with potential audit readiness required throughout the performance period.