Cybersecurity & CUI Safeguarding for Subcontractors

This contract requires subcontractors to implement robust cybersecurity measures to protect Controlled Unclassified Information in accordance with DFARS 252.204-7012. All covered information systems must adhere to the NIST SP 800-171 security requirements, ensuring appropriate safeguards for the confidentiality, integrity, and availability of CUI. Subcontractors are obligated to conduct self-assessments of their security controls and report results via the Supplier Performance Risk System, maintaining continuous compliance throughout the contract period. Any cyber incidents affecting the confidentiality, integrity, or availability of CUI must be reported to the Department of Defense within 72 hours of discovery, including detailed documentation of the incident, affected systems, and remediation steps taken. The subcontractor must also flow down these cybersecurity requirements to any lower-tier subcontractors handling CUI, ensuring a chain of accountability across the supply chain. System administrators and personnel with access to CUI are required to receive regular cybersecurity training, and the organization must maintain documented policies and procedures aligned with NIST standards. The place of performance and agency information indicate this is a Department of Defense-related subcontract administered by the Defense Logistics Agency, with compliance monitored as a mandatory condition of contract performance. Failure to meet these requirements may result in contract termination, financial penalties, or debarment from future DoD contracts.