Cybersecurity and Controlled Unclassified Information (CUI) Safeguarding

This contract requires the implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) across all systems and networks involved in the performance of work under the subcontract. The contractor must establish, maintain, and continuously validate compliance with these controls to ensure the confidentiality, integrity, and availability of CUI, aligning with the cybersecurity requirements mandated by the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012. All personnel with access to CUI must be trained on applicable policies and procedures, and security measures must be documented and auditable at all times to demonstrate adherence to federal standards. The contractor is also obligated to report any cyber incidents affecting CUI within 72 hours of discovery, providing detailed information to the Department of Defense as required by DFARS. Incident response plans must be active and tested, with capabilities to contain, investigate, and mitigate threats while preserving forensic evidence. The work is performed under a subcontract tied to the Defense Logistics Agency, with the North American Industry Classification System code 541512 indicating information technology services and specialized software development. Compliance is not optional and failure to meet these requirements may result in contract termination, financial penalties, or loss of eligibility for future defense contracts.