Cybersecurity and Covered Defense Information (CDI) Safeguarding

This contract obligates the contractor to implement comprehensive cybersecurity controls to safeguard covered defense information (CDI) generated or received during performance of the subcontract, in full compliance with the requirements of DFARS 252.204-7012. The controls must align with the National Institute of Standards and Technology (NIST) Special Publication 800-171 to ensure the confidentiality, integrity, and availability of CDI, covering all systems and networks handling such information. The contractor is required to establish and maintain an adequate security program that includes access controls, encryption, audit logging, incident response planning, and continuous monitoring. Any cybersecurity incident affecting CDI must be reported to the Department of Defense within 72 hours of discovery, including detailed documentation of the incident’s nature, scope, and impact. The contractor must also cooperate fully with any subsequent government investigation and provide requested evidence to support forensic analysis. Compliance is mandatory for all subcontractors and tiered entities involved in the performance of this work, and failure to adhere to these requirements may result in contractual penalties, termination, or loss of eligibility for future DoD contracts. The subcontract is issued under the Defense Logistics Agency, with performance tied to the broader Department of Defense supply chain, emphasizing the critical importance of secure information handling in national defense operations.