Cybersecurity and Data Compliance for Subcontractors

This contract requires all subcontractors to align their information technology systems with the cybersecurity standards outlined in NIST Special Publication 800-171 to properly safeguard Controlled Unclassified Information. The obligation applies to any entity handling CUI on behalf of the Defense Logistics Agency under the subcontract, ensuring that processes for access control, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, risk assessment, system and communications protection, and system and information integrity are fully implemented and documented. Compliance is mandatory throughout the lifecycle of the subcontract to maintain the integrity and confidentiality of sensitive defense-related data. The contract falls under NAICS code 541512, indicating it relates to computer systems design services, and is issued by the Department of Defense through the Defense Logistics Agency. While no specific place of performance or set-aside details are provided, the requirement applies universally to all subcontractors involved, regardless of location. Subcontractors must demonstrate ongoing adherence to NIST SP 800-171 controls through internal audits, policy documentation, and potential assessments, and failure to comply could result in termination of the subcontract or other contractual remedies. The engagement is active as of July 14, 2026, and is accessible via the DIBBS system for contract-specific details and performance tracking.