Cybersecurity Compliance and NIST SP 800-171 Assessment

The contract requires the performance of a cybersecurity compliance assessment for information systems against the NIST SP 800-171 Revision 1 standards, either through a self-assessment or by engaging a qualified third-party evaluator. The scope includes identifying gaps in security controls, documenting detailed findings, and submitting the results through the Supplier Performance Risk System (SPRS). If deficiencies are found, a Plan of Action and Milestones (POA&M) must be developed and included in the submission to outline how non-compliant areas will be remediated. The assessment must be thorough and aligned with federal requirements for protecting controlled unclassified information within contractor systems. The contract is a subcontract under the Department of Defense, specifically managed by the ASC SUPPLIER OPER OEM DIVISION, with performance expected to occur at Hill Air Force Base, Utah, zip code 84056-5734. The solicitation was posted on May 13, 2026, and responses are due by May 21, 2026. The North American Industry Classification System code is 541611, indicating the work involves management, scientific, and technical consulting services related to cybersecurity. This engagement is critical for ensuring defense supply chain security and maintaining compliance with federal cybersecurity mandates.