Cybersecurity & Controlled Information Safeguarding

The contract requires the implementation of NIST SP 800-171 controls to protect covered defense information across all systems and networks involved in performance, ensuring full compliance with DFARS 252.204-7012 for the reporting of cyber incidents. This subcontract mandates stringent cybersecurity practices to safeguard sensitive data, including the identification, enumeration, and remediation of vulnerabilities, as well as the establishment of access controls, incident response procedures, and continuous monitoring capabilities. All systems handling covered defense information must meet the minimum security requirements outlined in NIST SP 800-171, with documented evidence of control implementation available for audit or assessment. Performance is to be conducted at Oak Harbor, Washington, with a response deadline of August 3, 2026, and the work falls under NAICS code 541512, which pertains to computer systems design services. The contracting entity is the Defense Logistics Agency under the Department of Defense, and subcontractors must be prepared to demonstrate alignment with federal cybersecurity standards and possess the technical and procedural capacity to report any cyber incidents promptly and accurately. Compliance is mandatory and non-negotiable, with failure to meet these requirements potentially resulting in termination, financial penalties, or loss of future contracting eligibility.