Cybersecurity Compliance and Incident Response (Subcontractor Support)

The contract requires a subcontractor to implement and maintain comprehensive cybersecurity controls aligned with NIST SP 800-171 for systems processing covered defense information. This includes establishing technical and administrative safeguards to protect sensitive data, ensuring continuous monitoring for potential cyber threats, and enabling rapid detection of incidents. The subcontractor must have the capability to identify, document, and report any cyber incident to the Department of Defense within a strict 72-hour window, with detailed information on the nature, scope, and impact of the event. Additionally, the subcontractor is responsible for preserving all relevant forensic data to support investigative efforts, ensuring that evidence remains intact and accessible for compliance and response purposes throughout the duration of the contract. The work supports the Defense Logistics Agency under the Department of Defense, with performance tied to the broader cybersecurity posture of defense supply chain systems.