Subcontractor Cyber Incident Reporting and Media Preservation

The subcontract requires the contractor to maintain system images and data for a minimum of 90 days following any cyber incident, ensuring that forensic evidence remains intact and accessible for Department of Defense review. This obligation is mandated under DFARS 7012 and applies to all systems and data affected by a cybersecurity event, regardless of scale or impact. The contractor must preserve full system images, logs, and relevant digital artifacts without modification or deletion during this retention period to support DoD-led forensic investigations. The contract is classified as a subcontract under NAICS code 541511 and issued by the Defense Logistics Agency under the Department of Defense. It is enforceable regardless of the place of performance or specific geographic location, and compliance is non-negotiable as a condition of contract fulfillment. The DoD reserves the right to request, access, and examine preserved data at any time within the 90-day window to enable thorough incident analysis, attribution, and remediation. Failure to comply with these preservation and access requirements constitutes a material breach of contractual obligations and may result in remedial action or termination.