Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires full implementation of NIST SP 800-171 security controls to protect controlled unclassified information handled by covered systems. Compliance involves not only deploying the required technical and administrative safeguards but also conducting a thorough self-assessment of the implemented controls to verify adherence. The results of this assessment must be uploaded to the Supplier Performance Risk System to document and validate compliance status. Additionally, any cyber incident affecting these systems must be reported to the appropriate authorities within 72 hours to ensure timely response and mitigation. The work is performed under a subcontract tied to the Department of Defense, specifically the Defense Logistics Agency, with the work governed by the NAICS code for computer systems design services. All activities are focused on maintaining the integrity and security of sensitive government data in accordance with federal cybersecurity standards.