69373), which imposed certain requirements on contractors: compliance with certain NIST IT standards, mandatory reporting of cybersecurity incidents to the DoD, and a "flow-down" clause that applies the same requirements to subcontractors.[4]