Cybersecurity Compliance & Incident Reporting

The contract requires full implementation of NIST SP 800-171 security controls to protect Controlled Unclassified Information across all systems and environments under the subcontractor’s responsibility. This includes establishing, maintaining, and continuously monitoring safeguards to prevent unauthorized access, disclosure, or loss of CUI as mandated by DFARS 252.204-7012. All personnel and third-party vendors must comply with the specified technical and administrative requirements to ensure ongoing conformity with federal cybersecurity standards. The subcontractor is obligated to promptly detect, report, and respond to any cyber incidents affecting CUI within 72 hours of discovery, providing detailed forensic data and coordination as directed by the Department of Defense. Compliance is non-negotiable and subject to government oversight, with failure to meet obligations potentially resulting in contractual penalties, termination, or loss of future business opportunities. The work is performed under the Defense Logistics Agency as part of a broader Defense Department initiative, with performance tied to the subcontract identified by contract number SPE4A626F217E.