Cybersecurity Compliance for Covered Defense Information

The contract requires the implementation of all NIST SP 800-171 cybersecurity controls to safeguard covered defense information processed, stored, or transmitted by the contractor’s systems. Full compliance with DFARS 252.204-7012 is mandatory, ensuring the proper protection of controlled unclassified information as mandated by the Department of Defense. The contractor must establish and maintain a robust security posture that aligns with federal requirements, including access controls, audit logging, incident response, and system integrity protections. All activities must be performed in accordance with the standards set forth in NIST 800-171, with continuous monitoring and documentation to demonstrate ongoing compliance. This is a subcontract under the Defense Logistics Agency, classified under NAICS code 541512 for computer systems design services. The work is tied to the contract SPE8E726P0798 and is expected to support systems that handle sensitive defense contract information. The obligation extends to ensuring no unauthorized access or data exfiltration occurs, and the contractor must be prepared to respond to security incidents promptly and report them as required. There is no set-aside designation, and performance location details are unspecified, indicating the work may be conducted remotely or at various contractor facilities as long as compliance standards are uniformly enforced.