Cybersecurity and CUI Compliance for Subcontractors

This contract requires subcontractors to implement the cybersecurity controls outlined in NIST Special Publication 800-171 to protect Controlled Unclassified Information within their systems and environments. Compliance entails establishing and maintaining a robust security framework that aligns with federal standards for safeguarding sensitive data, ensuring that all CUI is handled, stored, and transmitted securely in accordance with mandated protocols. Subcontractors must also establish the capability to report cyber incidents promptly and accurately through the DoD’s Defense Industrial Base Cybersecurity and Supply Chain Risk Management system, known as DIBNet, to meet federal reporting obligations and maintain contractual standing. The work is classified as a subcontract under NAICS code 541512, indicating it involves computer systems design services, and is managed by the Defense Logistics Agency under the Department of Defense. The contract is not subject to a specific set-aside designation, and performance location details are not specified, suggesting the work may be conducted remotely or across multiple sites. All parties must adhere strictly to the cybersecurity requirements by the contract’s effective date, with ongoing monitoring and reporting obligations to ensure continuous compliance and readiness to respond to potential cyber threats affecting CUI integrity.