Cybersecurity for Covered Defense Information (CDI)

The contract requires the implementation and maintenance of cybersecurity controls aligned with NIST SP 800-171 to protect Covered Defense Information (CDI) in compliance with DFARS 252.204-7012. This subcontract mandates that all applicable security requirements be fully integrated into the contractor’s information systems to ensure the confidentiality, integrity, and availability of sensitive defense data. The contractor must establish and sustain a robust security posture through continuous monitoring, assessment, and documentation of control effectiveness, with full accountability for meeting federal cybersecurity standards. Performance is to be conducted primarily at the location in Tracy, California, with a response deadline of August 4, 2026. The contract falls under NAICS code 541512, classifying it as computer systems design and related services, and is issued by the Department of Defense through the ASC Supplier Operations OEM Division. While no specific set-aside provisions are indicated, full adherence to NIST controls and DFARS compliance is non-negotiable, and failure to meet these requirements may result in contract termination or penalties. The contractor is expected to demonstrate capable, verified systems for handling CDI without reliance on external documentation, ensuring all security practices are operational, auditable, and maintained throughout the contract lifecycle.