Cybersecurity Compliance and Incident Reporting

The contract requires the implementation and ongoing maintenance of security controls aligned with NIST SP 800-171 to ensure the protection of controlled unclassified information. Compliance with these controls is mandatory and must be continuously monitored and documented throughout the performance period. In the event of a cyber incident, the contractor is obligated to report the occurrence to the appropriate authorities within 72 hours, ensuring timely response and mitigation. Additionally, all digital media associated with the contract must be preserved for a minimum of 90 days to support forensic analysis, investigations, or audits as needed. The work is conducted under a subcontract issued by the Defense Logistics Agency under the Department of Defense, with performance governed by the NAICS code 541512 for computer systems design services.