Cybersecurity Compliance for Covered Defense Information (CUI)

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information, commonly referred to as Controlled Unclassified Information or CUI, in alignment with Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. This includes establishing, monitoring, and updating technical, physical, and administrative safeguards to ensure the confidentiality, integrity, and availability of CUI handled by the contractor. Compliance is mandatory and must be continuously upheld throughout the lifecycle of the contract. In addition to safeguarding CUI, the contract mandates timely and accurate reporting of any cyber incidents affecting covered systems through the Department of Defense Cyber Crime Center’s Defense Industrial Base Cybersecurity and Infrastructure Assurance Program portal, known as DIBNet. Failure to report incidents as required could result in contract violations and potential penalties. The contract is a subcontract classified under NAICS code 541512 and falls under the purview of the Defense Logistics Agency within the Department of Defense, with performance subject to federal cybersecurity standards regardless of geographic location.