Cybersecurity Compliance & Incident Reporting

All subcontractors handling Controlled Unclassified Information under this contract must fully implement the cybersecurity requirements outlined in NIST Special Publication 800-171 to safeguard CUI. This includes establishing and maintaining a compliant security framework across systems and networks, ensuring proper access controls, continuous monitoring, and regular assessment of security controls. Any cyber incident involving CUI must be reported to the Department of Defense through DIBNet within 72 hours of discovery, with detailed documentation of the incident, potential impact, and immediate containment actions taken. Compliance is mandatory for all subcontractors regardless of tier or scope of work, and failure to meet these requirements may result in termination of contractual obligations, financial penalties, or loss of eligibility for future defense-related work. The contract is governed under the Defense Logistics Agency and falls under NAICS code 541512 for computer systems design services, with performance obligations extending across all locations where CUI is processed, stored, or transmitted.