Cybersecurity Compliance and Incident Reporting

The contract requires full implementation of NIST SP 800-171 cybersecurity controls to ensure the protection of controlled unclassified information within the information systems of the subcontractor. A comprehensive System Security Plan must be developed and maintained to document the implementation, administration, and monitoring of these controls. The subcontractor is responsible for conducting regular self-assessments to evaluate compliance with the NIST framework and to identify any gaps or deficiencies that require remediation. In the event of a cyber incident, immediate reporting is mandatory through the DIBNet portal within seventy-two hours of discovery. Failure to report within this timeframe may result in noncompliance and potential contract penalties. The work is performed under a subcontract tied to the Department of Defense, specifically the Defense Logistics Agency, and falls under NAICS code 541512 for computer systems design services, indicating the technical nature of the cybersecurity obligations.