Cybersecurity Compliance and CUI Protection

This contract requires the implementation of NIST SP 800-171 security controls to protect covered defense information, ensuring compliance with DFARS 252.204-7012 requirements for safeguarding controlled unclassified information. The subcontractor must establish and maintain robust cybersecurity measures to prevent unauthorized access, disclosure, or loss of sensitive data, and is obligated to promptly report any cyber incidents affecting the integrity or confidentiality of covered defense information. The obligation extends throughout the contract’s five-year term, which runs from February 2024 to January 2029, and applies to all systems and processes handling such information regardless of location. The contract falls under NAICS code 541512, indicating it involves computer systems design and related services, and is issued under the Department of Defense through the Medical Supply Chain FSC. Although specific performance locations and point of contact details are not provided, the subcontractor is expected to adhere to federal cybersecurity standards across all operational environments. Compliance is mandatory and ongoing, with no set-aside provisions, meaning any qualified entity may respond. The requirement places full responsibility on the subcontractor to demonstrate and maintain a security posture aligned with NIST guidelines and to support DoD’s broader mission of protecting critical defense data.