Cybersecurity Compliance and CUI Safeguarding

The contract requires full implementation of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information handled by the subcontractor. All cyber incidents involving CUI must be reported through the Defense Industrial Base Cybersecurity and Supply Chain Risk Management portal within seventy-two hours of discovery. The contractor is obligated to flow down these same cybersecurity requirements to any downstream subcontractors who will access, process, or store CUI, ensuring consistent compliance across the entire supply chain. This obligation extends to maintaining documentation, enforcing adherence, and verifying that all parties meet the mandated protections without exception. The work falls under the NAICS code 541612 and is managed by the Defense Logistics Agency under the Department of Defense. The contract structure is strictly a subcontract, meaning the primary contractor assumes responsibility for ensuring all cybersecurity controls are met throughout their network of affiliated vendors. There is no specified geographic restriction for performance, and the solicitation was posted in June 2026, indicating it is a current and active procurement. Compliance is not optional; failure to report incidents in time or to enforce requirements on subcontractors could result in contractual breach and loss of eligibility to handle CUI.