Cybersecurity Compliance for Covered Defense Information

This contract requires strict adherence to DFARS 252.204-7012 and NIST SP 800-171 standards to protect Covered Defense Information, ensuring that all systems handling such data implement the specified cybersecurity safeguards. The subcontractor must establish and maintain a robust security framework that includes access controls, awareness training, audit and accountability measures, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. Any cyber incidents affecting Covered Defense Information must be reported promptly to the Department of Defense with detailed documentation and required forensic evidence. The requirement applies across all organizational components and third-party systems involved in the performance of the subcontract, regardless of location. Compliance is not optional and must be continuously demonstrated through documented policies, procedures, and technical controls verified through assessment or self-certification processes. The contract is issued under the Defense Logistics Agency as part of the Department of Defense’s broader initiative to secure sensitive defense data throughout the supply chain, with the NAICS code 541512 indicating the work involves computer systems design and related services.