Cybersecurity Compliance for Subcontractors

This contract requires subcontractors to implement and maintain the cybersecurity controls outlined in NIST SP 800-171 for all systems that process, store, or transmit covered defense information. Compliance with these controls is mandatory and must be sustained throughout the performance period to ensure the protection of sensitive information. Subcontractors are obligated to report any cyber incidents affecting covered systems through the Defense Industrial Base Cybersecurity and Incident Reporting Portal, commonly known as DIBNet, in accordance with established timelines and procedures. The contract falls under the NAICS code 541512, indicating it is related to computer systems design services, and is issued by the Defense Logistics Agency under the Department of Defense. It is structured as a subcontract, meaning performers must align their cybersecurity practices with the prime contractor’s obligations and the broader DOD cybersecurity framework. There is no set-aside designation specified, and performance location details are not provided, but compliance must be maintained wherever the subcontracted work is executed. The contract’s effective date is posted as July 17, 2026, and all activities must be conducted to meet federal cybersecurity standards without exceptions.