Cybersecurity Compliance for Covered Defense Information

The contract requires implementation of NIST SP 800-171 Rev 2 security controls on all non-federal systems that handle covered defense information, ensuring compliance with federal cybersecurity standards for protecting sensitive data. Contractors must establish and maintain controls to safeguard information systems, manage access, monitor activities, and respond to threats in alignment with the latest NIST guidance. All cyber incidents must be reported promptly through designated Department of Defense portals to ensure timely threat assessment and response coordination across the defense supply chain. Requirements must be flowed down to all subcontractors and tiered vendors who process, store, or transmit covered defense information, ensuring end-to-end compliance throughout the contractual relationship. This obligation extends to enforcing the same security measures, incident reporting protocols, and documentation standards at every level of the subcontracting hierarchy. The work is performed under the oversight of the Defense Logistics Agency and is classified as a subcontract within the NAICS code 541512, indicating it supports information technology services for defense-related cybersecurity needs.