Cybersecurity Compliance & Reporting (NIST SP 800-171)

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard controlled unclassified information within the contractor’s systems. This includes establishing, documenting, and sustaining technical and administrative safeguards aligned with the framework, ensuring continuous compliance throughout the contract lifecycle. The contractor is also responsible for conducting regular System Security Plan assessments and submitting accurate scores to the Supplier Performance Risk System to demonstrate adherence to federal cybersecurity requirements. Additionally, the contractor must promptly detect, report, and respond to any cyber incidents affecting covered defense information as mandated by DFARS 252.204-7012, including providing required information to the Department of Defense within specified timeframes. Failure to meet these obligations may result in performance penalties or loss of contract status. The work is performed as a subcontract under the Defense Logistics Agency, with performance obligations tied to the broader Department of Defense cybersecurity posture.