Cyber Incident Reporting and CUI Safeguarding

The contract mandates the implementation and maintenance of cybersecurity controls to protect covered defense information in compliance with DFARS requirements, focusing on the safeguarding of Controlled Unclassified Information. It requires the contractor to establish and sustain robust security measures aligned with NIST standards, ensuring that sensitive data is properly secured against unauthorized access, disclosure, or compromise throughout the lifecycle of the contract. The scope includes continuous monitoring, threat mitigation, and the integration of technical and administrative controls to meet federal cybersecurity obligations. Additionally, the contractor is obligated to promptly report any cyber incidents affecting covered defense information or the systems that process, store, or transmit such data. Reporting must follow specified DFARS timelines and formats, including submission through the DoD Cyber Incident Reporting Portal. This subcontract, issued under the Defense Logistics Agency within the Department of Defense, is tied to a specific contract vehicle and applies to all work performed under its scope, regardless of location. The contractor must maintain detailed documentation of all security practices, incident responses, and compliance activities to support audits and verification by government authorities.