Cybersecurity Compliance and Incident Reporting

The subcontract requires strict adherence to NIST SP 800-171 Rev. 2 for protecting controlled unclassified information and full compliance with DFARS 252.204-7012, ensuring robust cybersecurity practices across all applicable systems and processes. The subcontractor must implement required safeguards, maintain documentation of compliance, and support audits or assessments related to these standards. Any cyber incident affecting covered contractor information systems must be reported to the Department of Defense Industrial Base Cybersecurity Portal, DIBNet, within 72 hours of discovery, using only DoD-approved digital certificates to authenticate and securely transmit reports. Failure to meet these requirements may result in contract penalties, termination, or loss of eligibility for future DOD work. The contract falls under NAICS code 541512 and is administered by the Defense Logistics Agency under the Department of Defense, with performance obligations tied to the defense industrial base’s cybersecurity framework.