Cybersecurity Compliance & Incident Reporting

The contract requires the implementation of NIST Special Publication 800-171 security controls to safeguard covered defense information on nonfederal information systems, ensuring alignment with Department of Defense cybersecurity standards. It also mandates compliance with DFARS 252.204-7012, which obligates the contractor to report cyber incidents affecting covered defense information or the covered contractor information system within 72 hours of discovery, including detailed documentation and cooperation with government investigations. The scope applies to all subcontractors handling sensitive defense data and necessitates continuous monitoring, assessment, and documentation of control effectiveness, with full accountability for system integrity and data protection. The contract is classified as a subcontract under NAICS code 541512, issued by the Defense Logistics Agency under the Department of Defense, and is tied to award SPE7LX22D0068 with delivery order SPE7L126FAU4A. Performance is expected to occur across multiple locations without geographic restriction, though all systems involved must meet the specified regulatory standards. Compliance is mandatory, with potential penalties for failure to implement required controls or report incidents timely, and the contractor must maintain audit-ready records demonstrating full adherence to NIST 800-171 and DFARS requirements throughout the contract lifecycle.