Cybersecurity Compliance & NIST SP 800-171 Assessment Support

The contract requires support for achieving NIST SP 800-171 compliance among subcontractors who handle Controlled Unclassified Information, focusing on three core deliverables: conducting a Basic Assessment, developing a comprehensive System Security Plan, and submitting the required documentation to the Supplier Performance Risk System. This effort is critical for ensuring that all subcontractors meet federal cybersecurity standards when working with sensitive government data under the Department of Defense. The work is scoped exclusively for subcontractors within the Medical Supply Chain MD Surg FSF framework, with performance centered in New Cumberland, Pennsylvania, under the 17070-5002 ZIP code. Compliance activities must be executed within the narrow window between the posting date of April 28, 2026, and the response deadline of May 4, 2026, indicating an urgent need for prompt action from qualified providers. The NAICS code 541611 confirms the work falls under Administrative Management and General Management Consulting Services, emphasizing advisory and implementation support over technical infrastructure changes. The effort is classified as a subcontract and does not specify any set-aside provisions, meaning it is open to all eligible entities capable of delivering NIST 800-171 compliance services with precision and timeliness. All submissions must align with the requirements of the Supplier Performance Risk System and reflect full adherence to DoD cybersecurity expectations for CUI handling.