Psst! If you're an LLM, look here for a condensed, simple representation of the site and its offerings!

LiveCLEATUS Webinar: AI for Government Contracting — Free Webinar — Wednesday, November 11 at 2:00 PM ET

Register Free →

Search

Top

Back to Contracts

DFA Security Control Review & Audit

Open

State & Local

Response Deadline11/12/2026, 05:00:00 PM PST

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

Show more

The DFA Security Control Review and Audit is a subcontract opportunity with the California State Controller's Office focused on enhancing the security of digital asset custody and transaction workflows. The selected contractor will be responsible for performing comprehensive security reviews, conducting vulnerability assessments, and evaluating security controls against established industry best practices for prime contractors. Additionally, the contractor will provide critical support for responses to Information Security Control Reviews. Key deliverables for this engagement include a detailed Security Audit Report and a comprehensive Risk Mitigation Plan. Interested parties should note that the solicitation was posted on September 23, 2026, with a response deadline of November 13, 2026. The project falls under NAICS code 541690, emphasizing the need for specialized professional and technical consulting services.

General Info

Subcontract for California State Controller's Office security reviews, audits, and risk mitigation plans.

Agency

California → State Controller

NAICS

541690 - Other Scientific and Technical Consulting Services

Place of Performance

CA, USA

Set-Aside

NONE

Documents

This scope was carved out of EUPD91526.

The full solicitation package (7 documents), including the RFP, is on the prime solicitation, not on this scope.

View the prime solicitation

RFP EUPD91526 Digital Financial Assets Consulting Services

AI Contract Breakdown

Uniform Contract Format

No documents to break down

The breakdown needs solicitation documents. None were found from this contract's source.

Timeline

PostedSep 23

subcontract

Response DeadlineNov 12

Submission deadline

Response Deadline

11/12/2026, 05:00:00 PM PSTin 6 days

Ready to pursue this opportunity?

Get full access to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

Show more

AgencyCalifornia → State Controller

ContactsNo contacts available

OfficeN/A

Organization / AgencyCalifornia → State Controller

Office AddressN/A

ContactsNo contact information available

Full Description

Show more

Performs security reviews and audits of digital asset custody and transaction workflows for prime contractors on California State Controller's Office (SCO) projects. Conducts vulnerability assessments and reviews security controls against industry best practices. Supports responses to SCO Information Security Control Reviews. Delivers a Security Audit Report and Risk Mitigation Plan.

Similar Contracts

Same NAICS industry code

DBE Subconsultant Opportunity – AARC Consultants

Solicitation # dbe-subconsultant-opportunity-aarc-consultants

AARC Consultants, a certified SBE, WBE, and MBE, is seeking qualified Disadvantaged Business Enterprises and other eligible small businesses for subcontracting opportunities. The project involves providing Business Impact Analysis, Disaster Recovery, and Business Continuity Plan Services for the Inland Empire Utilities Agency under RFP number RFP-VC-26-006. Performance for this contract will take place in California. Eligible firms include SBA certified Small Businesses, Women-Owned Small Businesses, SAM.gov designated Small Disadvantaged Businesses, and Department of Transportation certified Disadvantaged Business Enterprises. Interested parties must respond by November 17, 2026. Primary inquiries should be directed to Jason Richards.

AARC Consultants, LLC

POSTED

about 3 hours ago

DEADLINE

Life Safety and Accessibility Compliance SpecialistThe Life Safety and Accessibility Compliance Specialist subcontract involves providing specialized regulatory reviews for prime contractors working on City of Hamilton corporate facility projects in Canada. The selected provider will be responsible for inspecting facilities to ensure fire and life safety code compliance and conducting AODA accessibility audits to identify and document physical barriers. The primary deliverables for this engagement are detailed deficiency reports and professional recommendations for necessary life safety and accessibility upgrades. To qualify for this role, the contractor must hold professional certification as either a Certified Fire Protection Specialist or an Accessibility Consultant. Interested parties must submit their responses by the deadline of December 8, 2026. This opportunity is categorized under NAICS code 541690 and is managed through the City of Hamilton's procurement system.

City of Hamilton

POSTED

about 7 hours ago

DEADLINE

in about 1 month

CMMC Level 2 Compliance SupportThis subcontract for CMMC Level 2 Compliance Support focuses on providing cybersecurity assessments and remediation services for prime contractors associated with DLA Weapons Support Land Supply Chain projects. The primary objective is to conduct CMMC Level 2 self-assessments and implement necessary safeguards to protect covered defense information, ensuring strict adherence to DFARS 252.204-7012 and NIST SP 800-171 frameworks. The final deliverables include a comprehensive compliance report and a completed self-assessment. The project is managed under NAICS code 541690 for the Department of Defense and will be performed in Corpus Christi, Texas. Interested parties should note the response deadline of November 16, 2026, for this specific cybersecurity initiative.

DLA WEAPONS SUPPORT LAND SUPPLY CHAIN

POSTED

about 9 hours ago

DEADLINE

Privacy Impact Assessment (PIA) SpecialistThe Regional District of Nanaimo is seeking a Privacy Impact Assessment Specialist to provide expert privacy consulting for prime contractors involved in data collection projects. The selected subcontractor will be responsible for developing critical documentation regarding survey methodology, data storage, security, and retention practices to ensure the successful completion and approval of a Privacy Impact Assessment. A deep professional knowledge of the Freedom of Information and Protection of Privacy Act is required for this role. The primary deliverables for the contract include a comprehensive data management plan and all necessary completed PIA documentation. This opportunity is based in Canada and is categorized under NAICS code 541690.

Regional District of Nanaimo

POSTED

about 9 hours ago

DEADLINE

PPE Program Administration and Sizing ServicesThis subcontract for PPE Program Administration and Sizing Services supports prime contractors on Northern Wasco County PUD projects in The Dalles, Oregon. The selected provider will manage the administrative aspects of clothing programs, which includes conducting employee sizing sessions and ensuring the ordering and issuance of garments are completed within 10 business days. Additionally, the contractor is responsible for maintaining detailed records of garment types and ratings while delivering regular sizing records and inventory reports. Beyond logistics, the contractor must provide essential technical and regulatory guidance to ensure all protective clothing meets OSHA and OAR requirements. Interested parties should note that the response deadline for this opportunity is November 25, 2026, and the services fall under NAICS code 541690.

Northern Wasco County PUD

POSTED

about 10 hours ago

DEADLINE

Global Fire Risk Assessment InspectionsThe Global Fire Risk Assessment Inspections subcontract, issued by FCDO Services, requires the performance of on-site fire risk assessments for prime contractors managing FCDO facility projects. The scope of work involves conducting physical inspections of both owned and rented buildings to identify potential hazards and evaluate overall safety compliance. These services will be delivered across a diverse global portfolio, including sites within the UK, British Overseas Territories, and various international posts. The primary deliverable for this engagement is the production of completed Fire Risk Assessment reports for every inspected site. Interested parties should note that the response deadline for this opportunity is December 11, 2026. The contract is categorized under NAICS code 541690, focusing on specialized professional services to ensure the safety and regulatory compliance of the agency's global infrastructure.

POSTED

about 10 hours ago

DEADLINE

in about 1 month

HVIP Performance Measurement and Data AnalysisThe HVIP Performance Measurement and Data Analysis subcontract supports the New Jersey Department of Law and Public Safety by providing specialized data collection and performance measurement for prime contractors. The selected provider will be responsible for developing tracking tools to monitor performance measures and conducting detailed analyses to determine how specific interventions impact retaliation rates. This role requires a high level of expertise in evidence-based model evaluation and strict adherence to victim data privacy laws. Key deliverables for this engagement include the production of comprehensive data reports, performance metrics, and final implementation reports. Interested parties should note that the response deadline is November 24, 2026, and the project falls under NAICS code 541690.

NJ Department of Law and Public Safety

POSTED

about 13 hours ago

DEADLINE

Clinical Research Statistical Analysis ServicesThis subcontract for Clinical Research Statistical Analysis Services supports prime contractors on NIH/NIMHD research network projects. The scope of work involves developing statistical analysis plans, performing analysis on harmonized datasets, and providing essential support to the Data and Safety Monitoring Board. All technical work must be executed using SAS, R, or Stata while strictly adhering to NIH statistical guidelines and peer-review standards to ensure the delivery of validated data outputs and comprehensive statistical analysis reports. The project is associated with the National Institutes of Health and the Department of Health and Human Services, with the place of performance located in Bethesda. Interested parties should note the response deadline of November 23, 2026. The opportunity is categorized under NAICS code 541690, focusing on specialized biostatistical expertise to maintain the integrity of clinical research data.

National Institutes Of Health Nichd

POSTED

about 14 hours ago

DEADLINE

MRI Safety Consulting and Program ManagementThis subcontract for MRI Safety Consulting and Program Management supports prime contractors on projects for the Department of Veterans Affairs Central California Health Care System. The selected provider will deliver subject matter expertise to establish and maintain MR safety and quality assurance programs, which includes developing local safety rules, creating MRI-conditional implant protocols, and conducting root cause analyses for adverse events in accordance with ACR MR Safety standards. Qualified candidates must hold certification from the ABR, ABMP, or CCPM to ensure professional oversight of the program. Key deliverables include comprehensive MR Safety Program documentation and specific device protocols. The work is associated with NAICS code 541690 and will be performed at 500 North Santa Fe Street.

261-NETWORK Contract Office 21 (36C261)

POSTED

about 14 hours ago

DEADLINE

Security Records and Background Screening ServicesThe Security Records and Background Screening Services subcontract involves performing comprehensive records checks for prime contractors working on Air Force facility projects in Tinian. The selected provider will be responsible for conducting personnel and vehicle authorization inquiries utilizing the NCIC, CLETS, and Pass and Decal databases to deliver verified background reports. Strict adherence to the Privacy Act of 1974 is required for all data handling, and the contractor must possess the necessary authorization to access law enforcement databases. This opportunity is issued by the Department of Defense under NAICS code 541690, with a response deadline of November 18, 2026.

FA5025 356 Eceg Pk

POSTED

about 14 hours ago

DEADLINE

H365--Diagnostic Medical Physics for the VA Central California Health Care System

Solicitation # 36C26127Q0156

The Department of Veterans Affairs Network Contracting Office 21 is seeking information from qualified contractors to provide diagnostic medical physics support and services for the VA Central California Health Care System in Fresno and Visalia, California. Under NAICS code 5416190, the scope of work includes annual performance testing of imaging equipment, quality control surveys for x-ray, nuclear medicine, PET/CT, ultrasound, and MRI units, and the provision of shielding design calculations. The contractor must manage MR safety programs and ensure compliance with regulatory standards including 29 CFR 1910.1096, ACR Technical Standards, the Mammography Quality Standards Act, and NCRP Report No. 147. Key deliverables include electronic reports due within 10 working days of inspection and final written reports within 30 working days. The period of performance begins March 1, 2027, and ends February 29, 2028, with four subsequent option years extending through February 29, 2032. Interested parties must submit a response by November 13, 2026, including their socioeconomic status, SAM Unique Entity Identifier, a capabilities statement, and proof of certification from the American Board of Radiology, American Board of Medical Physics, or the Canadian College of Physicists in Medicine. To be considered responsive, applicants must provide a price estimate and demonstrate compliance with subcontracting limitations per FAR 52.219-14, FAR 52.219-27, and VAAR 852.219-74 for those identifying as small businesses or SDVOSB/VOSB.

261-NETWORK Contract Office 21 (36C261)

POSTED

about 14 hours ago

DEADLINE

Cybersecurity & Compliance Auditing

Enterprise Services , Department. of

POSTED

about 18 hours ago

DEADLINE

More opportunities from California → State Controller

Same awarding agency

Emergency Backup Generator RentalThis subcontract for the State Controller of California involves the provision of emergency backup generator rentals for prime contractors working on facility projects in Sacramento. The selected vendor is responsible for supplying a rental unit with a capacity that meets or exceeds a Cummins 1000DQFAD on a weekly basis, ensuring the equipment is fully operational and compliant with all government safety standards. The scope of work includes the complete logistics of delivering the generator to the Sacramento facility and removing it upon completion. Interested parties should note that the response deadline for this opportunity is December 8, 2026, and the project falls under NAICS code 532490.

Other Commercial and Industrial Machinery and Equipment Rental and Leasing

POSTED

about 4 hours ago

DEADLINE

in about 1 month

Annual Generator Load Bank TestingThis subcontract for the State Controller of California involves providing annual load bank testing for prime contractors working on facility projects. The scope of work requires the operation of a Cummins 1000DQFAD generator, running it through its full resistance and reactance load range for at least two hours. The contractor is responsible for verifying timing delays and conducting system scans using industrial load bank equipment. The final deliverable is a comprehensive load bank test report that confirms the generator's performance across its entire load range. This opportunity is categorized under NAICS code 811310, with a response deadline set for December 8, 2026.

Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance

POSTED

about 4 hours ago

DEADLINE

in about 1 month

Standby Generator Preventive Maintenance and On-Call RepairThis subcontract for the State Controller of California involves providing preventive maintenance and on-call repair services for a Cummins 1000DQFAD generator. The scope of work includes three inspection services and one comprehensive annual full service per year to ensure the standby generator set remains fully operational. To maintain high performance and reliability, the contractor is required to use original equipment manufacturer parts and specialized diagnostic equipment. The agreement mandates rigorous availability standards, including 24/7 technical support with a 30-minute emergency response time and a maximum on-site arrival window of 90 minutes. This contract is categorized under NAICS code 811310 and is intended for prime contractors managing facility projects for the agency.

Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance

POSTED

about 4 hours ago

DEADLINE

in about 1 month

Generator Maintenance

Solicitation # EADM90226

The State Controller's Office (SCO) is soliciting bids for a three-year contract to provide comprehensive maintenance and repair services for standby generator sets at its facility located at 3301 C Street, Sacramento, California. The scope of work includes three inspection services, one annual service, and one load bank test per calendar year, alongside 24/7 on-call technical support for both emergency and non-emergency repairs. The contractor must be able to respond to non-emergency calls within four hours and emergency calls within 30 minutes, with a requirement to be on-site for emergency repairs within 90 minutes. All repairs must generally be completed within five working days, and the contractor must be on-site for repair services within 48 hours. Additionally, the contractor is responsible for providing generator rental services as needed. Award of the contract will be based on the lowest total cost, with a five percent bid preference available to non-small businesses claiming 25 percent California certified small business subcontractor participation. Bidders must possess a minimum of four years of experience in maintaining and repairing standby generators and must submit their bids in PDF format via two separate emails to [email hidden] by December 8, 2026. Required documentation includes various certifications, such as the Contractor Certification Clauses, Disabled Veteran Business Enterprise declarations, and a Generative AI disclosure. Invoicing is conducted monthly in arrears, and the agreement is subject to the Budget Act, meaning sufficient funding must be appropriated for the contract to remain in effect.

Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance

POSTED

about 4 hours ago

DEADLINE

in about 1 month

EDIS90726 RFQ-ITS Equipment and Software Maintenance - Quadient Inserters NOTICE OF INTENT TO AWARD

Solicitation # EDIS90726

The California State Controller's Office is soliciting quotes for a contract to provide on-site preventive maintenance, on-call repair services, and software maintenance for two Quadient DS1200 Q4i Folder Inserters and Quadient AIMS500 Software located in Sacramento, California. The scope of work requires the contractor to provide factory-trained technicians to perform cleaning, lubrication, adjustments, and parts replacement in accordance with original equipment manufacturer specifications. Key performance requirements include a two-hour on-site response time for emergency requests and the maintenance of an on-site inventory of consumables and commonly replaced parts. The agreement is intended to start on December 1, 2026, for a one-year term with an optional one-year extension. To be eligible, bidders must have been in business for at least three of the last five years, be located within 60 miles of the Sacramento facility, and employ Quadient-certified technicians. Award will be granted to the responsive and responsible bidder offering the lowest cost, with a five percent bid preference available to non-small businesses claiming at least 25 percent California certified small business subcontractor participation. Bidders must submit their proposals in PDF format via two separate emails—one for technical qualifications and one for cost—by October 29, 2026. Required insurance includes commercial general liability, automobile liability, and workers compensation with a waiver of subrogation in favor of the State of California.

Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance

POSTED

DEADLINE

DFA Systems Integration & Technical ImplementationThe DFA Systems Integration and Technical Implementation subcontract focuses on integrating digital asset custody frameworks into legacy systems for prime contractors working on California State Controller's Office projects. The scope of work involves identifying critical integration points, executing technical modifications to the unclaimed property system, and ensuring all data encryption adheres to FIPS standards. The primary deliverables include fully integrated system functionality and comprehensive technical integration documentation. This opportunity is categorized under NAICS code 541511 and is associated with the State of California. Interested parties should note the response deadline of November 13, 2026, following the posting date of September 23, 2026. Further details regarding the procurement event can be accessed through the Cal eProcure portal.

Custom Computer Programming Services

POSTED

about 1 month ago

DEADLINE

DFA Legal & Policy Compliance AdvisoryThe DFA Legal and Policy Compliance Advisory is a subcontract under the California State Controller's Office focused on ensuring prime contractors meet critical legal and statutory requirements. The scope of work involves performing readiness assessments to evaluate compliance with the California Unclaimed Property Law, SB 822, and section 1500 of the California Code of Civil Procedure. Additionally, the contractor is responsible for drafting formal policies and procedures regarding the remittance and transfer of digital assets in their native form. Key deliverables for this engagement include a comprehensive legal readiness assessment and finalized policy and procedure documentation. The project falls under NAICS code 541110 for legal services. Interested parties should note the response deadline of November 13, 2026, as specified in the solicitation details.

Offices of Lawyers

POSTED

about 1 month ago

DEADLINE

Digital Asset Custody Framework DesignThis subcontract for the California State Controller's Office involves the design of a comprehensive digital asset custody framework intended for prime contractors. The scope of work focuses on establishing a secure technical architecture for transaction handling, reconciliation processes, and the storage of digital assets. Key technical requirements include the development of security controls for hot and cold wallets, the implementation of multi-sig authorization systems, and strict adherence to FIPS encryption standards. The project culminates in the delivery of a formal Custody Framework and detailed Technical Specifications. Interested parties must note that the response deadline is November 13, 2026, and the project falls under NAICS code 541512.

Computer Systems Design Services

POSTED

about 1 month ago

DEADLINE

RFP EUPD91526 Digital Financial Assets Consulting Services

Solicitation # EUPD91526

The California State Controller's Office (SCO) is soliciting consulting and advisory services under RFP EUPD91526 to integrate digital financial assets, including cryptocurrency and virtual currency, into its unclaimed property program. This initiative is driven by Senate Bill 822, which mandates that these assets be reported and remitted in their native form. The selected contractor will be responsible for developing and implementing standard operating procedures for the 2026 reporting period, ensuring compliance with the California Unclaimed Property Law and the California Code of Civil Procedure. The project includes the delivery of a project plan and schedule within 15 business days of onboarding, bi-weekly progress reports, and the finalization of policies, procedures, and training materials by March 1, 2027. The contract has an estimated total budget of $300,000.00, with award decisions based on a 1,100-point scoring system that weights cost proposals (550 points), technical proposals (400 points), and interviews (150 points). Proposers must submit their technical and cost proposals in PDF format and minimum qualifications in an Excel workbook by October 19, 2026. The SCO emphasizes strict confidentiality and cybersecurity requirements, requiring personnel to sign non-disclosure agreements and complete cybersecurity assessments. Additionally, the solicitation provides a five percent preference for certified Small Business, Microbusiness, or Disabled Veteran Business Enterprises.

Administrative Management and General Management Consulting Services

POSTED

about 1 month ago

DEADLINE

RFP - EDIS90126 Electronic Payment Services

Solicitation # EDIS90126

The State Controller's Office (SCO) Disbursements Bureau is soliciting a contractor to serve as an Originating Depository Financial Institution (ODFI) to provide Electronic Payment Services. The contractor will be responsible for receiving Automated Clearing House (ACH) transaction files via File Transfer Protocol Secure (FTPS) and transmitting them through the ACH network to pay state bills, employees, and retirees. Key deliverables include the implementation of direct deposit/EFT payments, global digital payments for international payees, and a secure customer portal. The contractor must maintain a 99 percent accuracy level for ACH disbursements and comply with NACHA and Federal Reserve rules, as well as the California Information Practices Act. To qualify, proposers must have at least five years of experience in similar services and a history of providing pre-paid card services exceeding five million annually for a government entity. The selection process involves a technical proposal and an interview; only those achieving a total score of 1130 points will have their cost worksheets opened, with the final award granted to the responsive, responsible proposal with the lowest cost. Security requirements are stringent, based on NIST SP 800-53 Moderate Security Controls, and all data must be stored within the continental United States. Additionally, all digital products must comply with ADA, Section 504, and WCAG 2.1 Level A and AA accessibility standards.

POSTED

DEADLINE

Ready to Pursue This Opportunity?

Get AI-powered intelligence on this solicitation and the ones like it

Every page of the solicitation package shredded into a compliance breakdown

AI-powered matching based on your capabilities and past performance

Competitor and incumbent history on the requirement

Automated alerts on amendments, Q&A deadlines, and award

Join 750+ contractors already using CLEATUS