Cybersecurity Incident Reporting and Compliance

The contract requires full implementation of NIST SP 800-171 cybersecurity standards to protect controlled unclassified information within covered contractor information systems. This includes establishing and maintaining the required security controls, conducting ongoing assessments, and ensuring that all systems meet the prescribed compliance thresholds. The contractor must actively monitor for cyber incidents, detect potential threats in real time, and respond appropriately to mitigate impacts and prevent further compromise. Additionally, the contractor is obligated to report any cybersecurity incidents to the Department of Defense in strict accordance with DFARS clauses 252.204-7009 and 252.204-7018. Reporting must include detailed incident documentation, timelines, affected systems, data compromised, and actions taken, all submitted within the mandated timeframes. Failure to comply with these reporting requirements may result in contractual penalties or loss of eligibility for future DoD work. The subcontract falls under NAICS code 541512 for computer systems design services and is managed by the Defense Logistics Agency under the Department of Defense.