Flow-Down Cybersecurity for Subcontractors

Subcontractors under this agreement are required to fully implement the cybersecurity controls outlined in NIST Special Publication 800-171 to protect controlled unclassified information handled in support of the contract. Compliance with these controls is mandatory and must be maintained throughout the performance of all contractual obligations. In the event of a cyber incident, subcontractors must promptly report it in accordance with the requirements of DFARS 252.204-7012 and integrate their reporting processes with the prime contractor’s established systems to ensure timely and standardized communication of security events. The contract pertains to information technology services classified under NAICS code 541512 and is administered by the Defense Logistics Agency under the Department of Defense, with performance obligations tied to the broader defense supply chain. All subcontractors must align their cybersecurity posture and incident response protocols with federal standards to maintain eligibility and avoid contract noncompliance penalties.