Cybersecurity Compliance & Reporting (NIST SP 800-171)

This contract requires the implementation of NIST Special Publication 800-171 security controls to protect controlled unclassified information within nonfederal systems, as mandated by Department of Defense regulations. It encompasses full compliance with DFARS clause 252.204-7012, which outlines the requirements for safeguarding covered defense information and reporting cyber incidents, along with DFARS clause 252.240-7997, addressing the reporting of cyber incidents involving covered defense information. The contractor must establish, maintain, and continuously monitor a security posture aligned with NIST SP 800-171 requirements, ensuring timely reporting of any cyber incidents to the Department of Defense within 72 hours of discovery. All activities must be conducted in accordance with federal cybersecurity standards and documented to demonstrate ongoing compliance. The subcontract is issued under the North American Industry Classification System code 541512, indicating services related to computer systems design and related activities. It is managed by the Defense Logistics Agency within the Department of Defense and is intended to support the secure handling of sensitive defense information across the supply chain. Performance is expected to meet stringent compliance benchmarks for cybersecurity and incident response, and the contract remains active under the terms established by federal cybersecurity directives. No specific location for performance is designated, and the contract does not include a set-aside designation, making it open to qualified entities regardless of business size or certification status.