Cybersecurity Compliance and Incident Reporting (Flow-Down)

The subcontract requires strict adherence to cybersecurity standards outlined in DFARS 252.204-7012, mandating the safeguarding of Covered Defense Information wherever it is processed, stored, or transmitted. The subcontractor must implement appropriate security measures to protect this information and ensure compliance with federal cybersecurity requirements. Any cyber incident affecting the confidentiality, integrity, or availability of Covered Defense Information must be reported to the Department of Defense within 72 hours of discovery. Additionally, the subcontractor is obligated to preserve all evidence related to such incidents for a minimum of 90 days to support forensic analysis and investigation efforts by authorized government entities. This subcontract falls under NAICS code 541512 and is administered by the Defense Logistics Agency under the Department of Defense. It applies to all activities involving IT systems or data handled by the subcontractor, regardless of location, and the obligations are non-negotiable flow-down requirements. The contract is effective as of July 17, 2026, and no set-aside provisions apply. Failure to meet these cybersecurity, reporting, and evidence preservation obligations may result in contract termination, financial penalties, or loss of eligibility for future DoD work.