Cybersecurity Compliance & CUI Safeguarding (Subcontract Flow-Down)

This contract mandates subcontractors handling covered defense information related to fuel logistics, billing, or reporting to implement all required controls outlined in NIST SP 800-171 to safeguard controlled unclassified information. Subcontractors must establish and maintain a compliant cybersecurity posture, ensuring proper access controls, data encryption, audit logging, and system integrity measures are in place across all environments where such information is processed, stored, or transmitted. Compliance is non-negotiable and must be continuously maintained throughout the performance of subcontracted work. In addition to control implementation, subcontractors are obligated to promptly report any cyber incidents involving covered defense information to the appropriate government authorities within established timeframes. This includes identifying, containing, mitigating, and documenting incidents, as well as cooperating fully with any subsequent investigations. The contract flows down these obligations from the prime contractor to all tiers of subcontractors, ensuring end-to-end compliance across the supply chain. The work is governed under the Department of Defense's oversight through the Defense Logistics Agency and falls under NAICS code 541512 for computer systems design services.