Cybersecurity Compliance (CUI/CDI Protection)

The contract requires implementation of all NIST SP 800-171 security controls to protect Covered Defense Information, ensuring that any sensitive unclassified information related to defense contracts is handled in compliance with federal cybersecurity standards. This includes establishing robust access controls, audit mechanisms, configuration management, and incident response protocols to mitigate risks to the confidentiality, integrity, and availability of CDI. The subcontractor must maintain continuous compliance with these controls throughout the performance period and is obligated to report any cybersecurity incidents involving CDI in accordance with DFARS 252.204-7012, including timely notification to the Department of Defense and submission of required forensic data as directed. This agreement falls under the NAICS code 541512 for Computer Systems Design Services and is categorized as a subcontract under the Defense Logistics Agency, a component of the Department of Defense. Although specific performance location details are not provided, the work is expected to occur in environments capable of meeting stringent federal cybersecurity requirements. The contract underscores the critical importance of proactive cyber hygiene and accountability, with non-compliance potentially resulting in contract termination, financial penalties, or loss of eligibility for future defense work. All activities must align with the Defense Department’s overarching mission to secure controlled unclassified information across its supply chain.