Cybersecurity Compliance & Incident Reporting for Subcontractors

All subcontractors handling covered defense information related to fuel delivery or supply must comply with NIST SP 800-171 security requirements to protect the confidentiality, integrity, and availability of sensitive data. This includes implementing specific technical, administrative, and physical safeguards outlined in the NIST framework to ensure robust cybersecurity postures. Subcontractors are also obligated to report any cyber incidents affecting covered defense information within 72 hours of discovery, providing detailed documentation and cooperating fully with government investigations as mandated by DFARS 252.204-7012. Compliance is mandatory throughout the duration of the subcontract, and failure to meet these requirements may result in termination, financial penalties, or loss of eligibility for future defense contracts. The contract applies universally to all tiers of subcontractors involved in fuel supply chain activities under the Defense Logistics Agency and is governed by Department of Defense cybersecurity standards.