Cybersecurity Compliance Support (If CDI is Handled)

This contract requires the subcontractor to ensure compliance with NIST SP 800-171 standards whenever their systems process or store Covered Defense Information, implementing all required security controls to safeguard sensitive government data. The subcontractor must establish and maintain a robust cybersecurity posture aligned with federal requirements, including continuous monitoring, access control, audit logging, and incident preparedness measures. In the event of a cyber incident involving CDI, the subcontractor is obligated to promptly report the incident as mandated by federal regulations and provide full forensic support to enable investigation, root cause analysis, and remediation efforts. The scope applies only when CDI is present within subcontractor systems, and the subcontractor must be capable of demonstrating full adherence to these requirements upon request. This agreement is part of a larger Department of Defense procurement managed by the Defense Logistics Agency under NAICS code 541512, and the obligation to comply is tied directly to the handling of defense-related information.