Cybersecurity Compliance for Subcontractors (CDI Handling)

Subcontractors managing Covered Defense Information must adhere to the cybersecurity requirements outlined in NIST Special Publication 800-171, ensuring the protection of sensitive data through standardized security controls. Compliance with these controls is mandatory and applies to all systems and processes handling such information, regardless of the subcontractor’s size or location. Any cyber incident affecting Covered Defense Information must be reported to the Supplier Performance Risk System within 72 hours of discovery, with timely and accurate reporting being a critical obligation under the contract. The subcontract falls under NAICS code 541512 and is managed by the Defense Logistics Agency under the Department of Defense, with performance expectations tied directly to federal cybersecurity standards and incident response protocols.