Cybersecurity Compliance (NIST SP 800-171) and CUI Protection

The contract requires implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information across all systems and processes, ensuring full compliance with DFARS 252.204-7012 requirements. This includes establishing and maintaining a robust cybersecurity framework to protect CUI at rest, in transit, and in use, with specific emphasis on access control, audit and accountability, configuration management, and incident response capabilities. The contractor must also establish procedures for timely detection, reporting, and containment of cyber incidents through the DoD’s DIBNet portal, aligning with the mandated reporting timelines and forensic evidence collection standards. This subcontract, issued under the Defense Logistics Agency within the Department of Defense, falls under NAICS code 541512 and is designed to support the broader objective of securing defense supply chain information. Compliance is non-negotiable, and all systems handling CUI must undergo continuous monitoring, assessment, and documentation to demonstrate adherence to the NIST framework. The contract implicitly requires the contractor to maintain valid security plans, conduct periodic risk assessments, and train personnel on CUI handling protocols, with potential consequences for noncompliance including contract termination or legal liability. Place of performance and specific delivery locations are not specified, implying coverage across all operational environments where CUI is processed or stored by the contractor.