Cybersecurity Compliance and Reporting

The contract requires the implementation and ongoing maintenance of all NIST SP 800-171 cybersecurity controls to protect controlled unclassified information within covered contractor information systems. Full compliance with these controls is mandatory, covering areas such as access control, audit and accountability, configuration management, identification and authentication, and incident response. Any cyber incident involving the compromise or potential compromise of covered information must be reported to the Department of Defense within 72 hours of discovery, with timely and accurate documentation of the event. The contractor must preserve all forensic data related to the incident, including system images, logs, and other relevant evidence, for a period sufficient to support investigation and remediation efforts as dictated by DFARS 252.204-7012. This subcontract is issued under the Defense Logistics Agency, operates under NAICS code 541512 for computer systems design services, and is subject to the full compliance requirements of the Department of Defense.