Cybersecurity and Data Safeguarding (for Subcontractors)

This contract mandates the implementation of foundational cybersecurity safeguards for covered contractor information systems to ensure compliance with FAR 52.204-21 and DFARS 252.204-7012, specifically targeting subcontractors working under the Defense Logistics Agency. The requirement focuses on establishing basic security measures to protect controlled unclassified information processed, stored, or transmitted on contractor systems, including the implementation of access controls, malware protection, audit logging, and configuration management consistent with NIST Special Publication 800-171. All subcontractors must meet these standards to maintain eligibility under the Department of Defense contract framework, with non-compliance leading to potential termination or loss of subcontracting privileges. The contract is designated as a subcontract under NAICS code 541512 for computer systems design services, and while no specific geographic performance location is identified, all covered systems must adhere to federal cybersecurity protocols regardless of their location. The solicitation is published by the Defense Logistics Agency, reflecting the Department of Defense’s commitment to securing its supply chain against cyber threats. Subcontractors are expected to demonstrate ongoing compliance through documentation and, if required, assessments, with the obligation extending throughout the life of the subcontract. Failure to implement required safeguards may result in breach of contract and liability under federal acquisition regulations.