Cybersecurity Compliance and SPRS Reporting

The contract requires implementation of all NIST SP 800-171 cybersecurity controls to protect controlled unclassified information within the system environment. A comprehensive and current system security plan must be maintained and updated regularly to reflect the current security posture and control implementation status. Annual reporting of the Supplier Performance Risk System scores is mandatory, ensuring continuous visibility into the contractor’s cybersecurity compliance performance. The contractor is also obligated to support cyber incident response activities in accordance with DFARS 252.204-7012, including timely detection, reporting, and coordination with government authorities in the event of a security breach or compromise. All activities must align with Department of Defense standards and be performed under the Defense Logistics Agency’s oversight, with performance taking place within the broader DoD framework.