Cybersecurity Compliance & Reporting (NIST SP 800-171)

The subcontractor is required to fully implement the cybersecurity controls outlined in NIST Special Publication 800-171 to protect Controlled Unclassified Information handled on behalf of the Defense Logistics Agency. This includes establishing and maintaining a robust information security posture aligned with federal standards, ensuring all systems and processes that store, process, or transmit CUI are compliant with the specified requirements. The subcontractor must also promptly report any cyber incidents affecting CUI to the appropriate government authorities and maintain an up-to-date SPRS assessment score, demonstrating ongoing adherence to cybersecurity protocols. Failure to meet these obligations may result in non-compliance penalties or contract termination. The work under this subcontract falls under NAICS code 541512, indicating it involves computer systems design and related services, and is tied to the Department of Defense’s supply chain security initiatives. Performance is expected to occur under the oversight of the Defense Logistics Agency without geographic restrictions specified, and the subcontractor must remain agile in responding to evolving cybersecurity threats and reporting mandates. Continuous monitoring, documentation, and submission of SPRS assessments are mandatory to validate compliance, making cybersecurity governance a core component of contract execution.