Cyber Incident Reporting and CDI Safeguarding (IT Security Compliance)

The contract requires implementation of NIST Special Publication 800-171 security controls to safeguard covered defense information handled by the contractor, ensuring comprehensive protection against unauthorized access, disclosure, or compromise. Compliance with these controls is mandatory and must be maintained throughout the duration of the subcontract, covering all systems and environments where covered defense information is processed, stored, or transmitted. The contractor is obligated to establish and sustain operational cybersecurity practices aligned with NIST SP 800-171, including access control, audit accountability, configuration management, and incident response capabilities. In addition to safeguarding sensitive information, the contract mandates strict adherence to a 72-hour cyber incident reporting requirement to the Department of Defense. Any suspected or confirmed cyber incident involving covered defense information must be reported within three days of discovery, regardless of whether the incident is confirmed or suspected. This reporting obligation is critical to maintaining DoD’s situational awareness and response coordination, and failure to meet the timeline may result in contractual penalties or loss of eligibility for future work. The subcontract falls under NAICS code 541512 and is administered by the Defense Logistics Agency, with performance expected to align with federal cybersecurity standards and DoD expectations for contractor accountability.