Cybersecurity Compliance & Incident Reporting (Subcontractor Flow-Down)

Subcontractors handling covered defense information under this agreement are required to implement the cybersecurity controls outlined in NIST Special Publication 800-171 to safeguard sensitive data. They must promptly report any cyber incidents to the appropriate authorities within 72 hours of discovery and are obligated to preserve all forensic evidence and related data in accordance with the Defense Federal Acquisition Regulation Supplement clause DFARS 252.204-7012. This requirement applies to all subcontractors across the supply chain, ensuring consistent protection of controlled unclassified information. The contract is a flow-down obligation tied to the Defense Logistics Agency’s award under the Department of Defense, with the underlying solicitation linked to the NAICS code 541512 for computer systems design services. Compliance is mandatory and non-negotiable, with failure to meet these standards potentially resulting in contractual penalties or termination.