IT Security & Data Compliance Support

The contract requires the contractor to ensure all software deliverables and internal systems fully comply with Caltrans IT security policies, mandating the use of AES-256 encryption for data at rest and in transit, comprehensive access logging to track system activity, and prompt reporting of any security breaches. All systems must adhere to FIPS 140-2 standards for cryptographic modules, ensuring the integrity and protection of sensitive transportation data. The contractor is obligated to support ongoing audits by providing verifiable evidence of compliance, including documentation, logs, and certification records that demonstrate adherence to these stringent security requirements throughout the lifecycle of the deliverables. This subcontract is issued by the California Department of Transportation under NAICS code 541511 for information technology services, with a response deadline of August 20, 2026. The work is directly tied to Caltrans operations and must be performed in alignment with state-level security mandates. Although the physical location of performance is unspecified, the compliance obligations apply regardless of where the work is executed, focusing on the security posture of systems handling Caltrans data. The contractor must maintain rigorous controls and be prepared to demonstrate continuous compliance under audit, with failure to meet requirements potentially resulting in contract non-compliance or termination.