Subcontractor Cybersecurity Flow-Down Management

All subcontractors under this agreement must fully comply with DFARS 252.204-7012 and 252.204-7020 by flowing down all applicable cybersecurity requirements to their own subs and suppliers. The prime contractor is responsible for verifying that every subcontractor implements the NIST SP 800-171 security controls as mandated and maintains documented evidence of compliance. Additionally, each subcontractor must maintain current and accurate reporting in the Supplier Performance Risk System (SPRS), ensuring visibility of their cybersecurity posture. The contract is managed under NAICS code 541611 by the Department of Defense’s Aviation Supply Chain office, with performance taking place in Jacksonville, Florida, at zip code 32212-0103. Responses must be submitted by May 19, 2026, and all parties are expected to uphold stringent protections for covered defense information throughout the subcontracting lifecycle.