Cybersecurity Compliance and NIST SP 800-171 Assessment

The contractor is required to perform a NIST SP 800-171 Rev 1 assessment of its information system to ensure the protection of controlled unclassified information, with a specific mandate to achieve a high assessment rating. If the assessment results in a high rating, the contractor must submit the findings through the Supplier Performance Risk System. This requirement is critical to maintaining compliance with federal cybersecurity standards for safeguarding sensitive data within the Department of Defense’s supply chain. The work must be completed in alignment with NIST guidelines and submitted by the deadline to meet contractual obligations. The contract is a subcontract under the Medical Supply Chain FSH agency, with a place of performance in San Antonio, Texas, 78226. It falls under NAICS code 541611, indicating it is related to management, scientific, and technical consulting services. The solicitation was posted on April 29, 2026, with a response deadline of May 6, 2026. The contractor must ensure that its systems, processes, and documentation meet all necessary criteria for CUI protection and that the assessment outcome is accurately reported through the required official platform. Failure to achieve or report a high rating may result in noncompliance and potential contract penalties.