Cybersecurity Compliance and Incident Reporting

This contract obligates the subcontractor to fully comply with Defense Federal Acquisition Regulation Supplement cybersecurity requirements, specifically mandating adherence to NIST SP 800-171 controls for protecting controlled unclassified information within nonfederal systems. The subcontractor must implement robust cybersecurity measures and promptly report any cyber incidents affecting covered defense information, following the timelines and procedures outlined in DFARS 252.204-7012. Additionally, the subcontractor is required to vet its supply chain to ensure no prohibited telecommunications or video surveillance equipment or services from specified foreign entities are incorporated into any deliverables or services, aligning with the statutory restrictions under the National Defense Authorization Acts. Compliance is mandatory throughout the lifecycle of the subcontract, and failure to meet these requirements may result in contractual penalties, termination, or debarment from future DoD engagements. The work is performed under the auspices of the Defense Logistics Agency as part of a broader Department of Defense procurement initiative.