Cybersecurity Assessment and Scoring Services

The contract seeks a subcontractor to perform an independent cybersecurity assessment aligned with NIST SP 800-171 requirements, evaluating the current compliance posture of systems within the Department of Defense’s Medical Supply Chain environment. The assessment must identify gaps against the 110 security controls, assign a precise compliance score such as 105 out of 110, and deliver a detailed, actionable roadmap to achieve full compliance. This roadmap must include specific steps, timelines, resource requirements, and remediation strategies to close all identified gaps. Completion of the assessment must also result in the preparation and submission of the required Supplier Performance Risk System (SPRS) record to officially document the organization’s cybersecurity status. The work is to be performed at the designated place of performance in Williamsburg, Virginia, with a ZIP code of 23185-5830, under the NAICS code 541690 for other scientific and technical consulting services. The solicitation was posted on May 11, 2026, and responses are due by May 18, 2026. The contract is structured as a subcontract under the Medical Supply Chain MD Surg FSF, and while no set-aside classification is specified, performance is governed by federal cybersecurity compliance standards and reporting obligations tied to DoD supply chain security requirements. All deliverables must be accurate, comprehensive, and formatted to meet SPRS submission standards to ensure the contractor meets the DoD’s risk mitigation objectives.