Cybersecurity and CUI Compliance for Subcontracted IT or Data Services

Subcontractors providing IT or data services under this contract are required to implement robust cybersecurity measures aligned with NIST Special Publication 800-171 to protect covered defense information and controlled unclassified information. Compliance with these standards is mandatory and applies to all systems and networks handling such data, regardless of location or infrastructure type. The contract mandates immediate reporting of any cyber incident affecting covered information, with a strict 72-hour window from discovery to notification, ensuring timely response and mitigation across the defense supply chain. This requirement is enforced under the broader regulatory framework of the Department of Defense and applies to all subcontractors engaged by the Defense Logistics Agency, with performance obligations tied directly to the integrity and security of defense-related data. The contract is classified under NAICS code 541512, indicating its focus on computer systems design services, and remains active under the terms specified by the Defense Logistics Agency.