Cybersecurity Compliance for Subcontractors Handling CUI

Subcontractors handling covered defense information under this agreement are required to implement the cybersecurity controls outlined in NIST SP 800-171 Revision 2 to protect controlled unclassified information. They must also adhere to the reporting and safeguarding requirements specified in DFARS 252.204-7012, including the prompt notification of any cyber incidents affecting the integrity, confidentiality, or availability of the information. Compliance is mandatory for all subcontractors performing work that involves access to or processing of sensitive defense data, regardless of their location or size. The contract falls under NAICS code 541512 for computer systems design services and is administered by the Defense Logistics Agency under the Department of Defense, with performance obligations tied to the broader defense supply chain. Failure to meet these cybersecurity standards may result in contract termination, financial penalties, or exclusion from future opportunities.