Cybersecurity Compliance for Subcontractor Systems

The contract requires subcontractors to ensure their information systems fully comply with NIST SP 800-171 and DFARS 252.204-7012 standards to protect covered defense information. This includes implementing all required security controls to safeguard sensitive data, maintaining robust cybersecurity practices, and establishing procedures for timely detection and reporting of cyber incidents as mandated by federal regulations. Compliance is non-negotiable and applies to all systems handling covered defense information under the subcontract. The contract is issued by the Defense Logistics Agency under the Department of Defense and falls under NAICS code 541512 for computer systems design services. It is structured as a subcontract and does not specify a set-aside type or point of contact. Performance location details are not provided, but compliance obligations apply regardless of geographic location. The subcontractor must maintain verifiable evidence of adherence to these cybersecurity requirements and be prepared for audits or assessments to confirm ongoing compliance. Failure to meet these standards could result in contract termination or financial penalties.