Cybersecurity Compliance (CUI Handling)

The contract requires all systems handling Controlled Unclassified Information to fully comply with NIST Special Publication 800-171, mandating the implementation of all applicable security controls to protect the confidentiality, integrity, and availability of such data. Contractors must conduct regular self-assessments to validate compliance and maintain detailed documentation of their security posture, ensuring continuous alignment with federal standards. Any identified cyber incident involving CUI must be reported to the appropriate authorities within 72 hours, with immediate mitigation efforts initiated to contain and remediate threats. The contract applies to subcontractors supporting the Defense Logistics Agency under a Department of Defense procurement, with compliance obligations extending to all personnel, systems, and third-party vendors involved in CUI handling. The work is classified under NAICS code 541512 for computer systems design services and is structured as a subcontract tied to a specific defense logistics contract. Performance is expected to occur wherever the contractor’s operations support the CUI requirements, regardless of physical location. No specific place of performance or point of contact is outlined, indicating flexibility in execution but placing full responsibility for compliance on the contractor. The contract underscores the critical importance of proactive cybersecurity measures and accountability, with adherence to NIST SP 800-171 serving as a non-negotiable condition of retention and continued performance under the subcontract.