Cybersecurity Compliance and Incident Reporting

Subcontractors handling covered defense information are required to implement the cybersecurity controls outlined in NIST SP 800-171 to protect the confidentiality, integrity, and availability of sensitive data. This contract mandates full compliance with all specified security requirements, including the establishment of robust access controls, audit logging, system configuration management, and incident response capabilities. Subcontractors must also establish and maintain procedures for the timely detection, reporting, and documentation of cyber incidents affecting covered defense information, ensuring alignment with Department of Defense reporting protocols and timelines. Performance of these obligations is tied to the safeguarding of information throughout the subcontractor’s system environment, with ongoing accountability for adherence to federal cybersecurity standards. The requirement applies to all subcontractors working under the Defense Logistics Agency and is enforced as a condition of contract performance, irrespective of contract location or structure.