Cybersecurity Compliance and Reporting for Subcontractors

Subcontractors under this agreement must implement all cybersecurity controls specified in NIST SP 800-171 to safeguard controlled unclassified information handled on systems supporting the Nuclear Reactor Program. Compliance is mandatory for any system processing, storing, or transmitting CUI, and subcontractors are required to maintain continuous adherence to these standards throughout the contract period. In the event of a cyber incident, immediate reporting through the Defense Industrial Base Cybersecurity Assessment and Compliance portal is required, ensuring timely response and coordination with federal authorities. Additionally, subcontractors must preserve all forensic data related to potential security breaches or anomalies for a minimum of 90 days, enabling thorough investigation and audit readiness. The performance location is designated as Hill Air Force Base with a zip code of 84056-5734, and the NAICS code 541512 indicates the scope relates to computer systems design services. All contractual obligations flow down from the prime contractor and are enforceable under Department of Defense requirements.