Cybersecurity for Covered Defense Information (CDI)

The contract requires the implementation of NIST SP 800-171 controls to safeguard Covered Defense Information (CDI) and the development of a comprehensive System Security Plan (SSP) that documents how these controls are applied and maintained across all relevant systems. Compliance with DFARS 252.204-7012 mandates that any cyber incident affecting CDI must be reported to the Department of Defense within 72 hours of discovery, ensuring timely response and mitigation. The contractor must establish robust security measures to prevent unauthorized access, disclosure, or modification of sensitive defense data, with ongoing monitoring and documentation to maintain eligibility under the terms of the agreement. This is a subcontract under a Women-Owned Small Business Set-Aside, assigned NAICS code 541512 for Computer Systems Design Services, and is managed by the Department of Defense through the agency named CONSTRUCTION & EQUIPMENT MANU & CON. The place of performance is located in Tracy, California, with a ZIP code of 95304-5000. Offers must be submitted by the response deadline of August 17, 2026, following the solicitation posted on August 5, 2026, through the DIBBS platform. All activities must align with federal cybersecurity standards and the specific obligations tied to handling controlled unclassified information for defense purposes.