Defense Supply Chain Cybersecurity and Reporting

The contract mandates the implementation of NIST SP 800-171 security controls across systems that handle Covered Defense Information, requiring full compliance with all specified safeguarding requirements to ensure the confidentiality, integrity, and availability of sensitive data. Contractors must establish and maintain robust cyber defense protocols aligned with the NIST framework, including access controls, audit logging, malware protection, and configuration management, all tailored to the environment of systems processing classified or unclassified controlled defense information. In addition, immediate reporting of any cyber incidents through the Defense Industrial Base Cybersecurity and Incident Reporting Portal, known as DIBNET, is required, with strict timelines and detailed documentation protocols to ensure timely response and coordination with federal authorities. Furthermore, the contract enforces strict media preservation standards for all digital and physical media containing Covered Defense Information, requiring secure handling, retention, and disposal practices in accordance with federal guidelines. Media must be inventoried, tagged, and protected throughout its lifecycle to prevent unauthorized access, loss, or corruption, and all storage and transfer procedures must align with established government-wide data stewardship policies. This subcontract is issued under NAICS code 541512 by the Defense Logistics Agency under the Department of Defense, with a response deadline in early May 2026, and applies to subcontractors supporting defense supply chain cybersecurity operations regardless of geographic location.