NIST SP 800-171 Cybersecurity Compliance

The contract requires full implementation of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information within the contractor’s systems and processes. Compliance with DFARS 252.204-7012 is mandatory, ensuring that all CUI is handled, stored, and transmitted according to federal defense standards. The contractor must establish and maintain robust security measures aligned with NIST guidelines and be prepared to report any cyber incidents promptly through the Defense Industrial Base Cybersecurity and Incident Reporting Portal, commonly known as DIBNet. All activities must be conducted to meet Department of Defense requirements under the Defense Logistics Agency’s subcontract, with performance obligations tied to the protection of sensitive defense-related information. This subcontract falls under NAICS code 541512, indicating it involves computer systems design and related services, and is part of the broader defense acquisition framework. While specific location details for performance are not provided, the obligation to comply with federal cybersecurity mandates applies regardless of geographic execution. The contract underscores a strict accountability framework for incident response and continuous compliance, demanding proactive monitoring, documentation, and reporting capabilities. Failure to adhere to these requirements may result in contractual penalties or loss of eligibility for future defense work.