Cybersecurity Compliance & Reporting (DFARS 252.204-7012)

The contract requires full implementation and ongoing monitoring of NIST SP 800-171 security controls to safeguard covered defense information, ensuring compliance with DFARS 252.204-7012 standards. This includes establishing robust procedures for handling controlled unclassified information, enforcing access controls, maintaining audit logs, and ensuring timely reporting of any cyber incidents as mandated by federal regulations. The subcontractor must maintain continuous adherence to these cybersecurity requirements throughout the performance period, with emphasis on protecting sensitive data processed, stored, or transmitted on information systems. The work is performed under a subcontract linked to the Department of Defense, specifically managed by the Defense Logistics Agency, and is classified under NAICS code 541512 for computer systems design services. Compliance is non-negotiable and tied to contractual obligations, requiring documented evidence of control implementation, regular assessments, and immediate notification of breaches or security events. Although specific performance locations and point of contact details are not provided, the obligation extends to any facility or environment where covered defense information is handled, and all activities must align with DoD cybersecurity policy frameworks.