CYBERSECURITY COMPLIANCE & NIST SP 800-171 ASSESSMENT

The contract requires the performance of a cybersecurity compliance assessment under NIST SP 800-171 Rev 1 for systems handling controlled unclassified information, with a focus on verifying the implementation of all required security controls. The vendor must develop a comprehensive System Security Plan that details how these controls are applied, documented, and maintained within the environment. All findings and supporting documentation must be compiled and submitted to the Supplier Performance Risk System to demonstrate compliance. The assessment includes verification of control effectiveness, generation of compliance artifacts, and reporting of organizational identifiers such as the CAGE code to ensure proper alignment with defense supply chain requirements. Performance is tied to a specific location at Cherry Point, North Carolina, with a deadline for submission set for May 18, 2026, under a subcontract structure coordinated by the Department of Defense’s Aviation Supply Chain ESOC Buys unit.