Cybersecurity Compliance and NIST SP 800-171 Implementation

This contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Covered Defense Information within the scope of the Medical Supply Chain MD Surg FSF program under the Department of Defense. The successful bidder must develop a comprehensive System Security Plan that documents all security controls, their implementation status, and associated risk management practices, ensuring full compliance with federal cybersecurity requirements for handling sensitive defense data. Additionally, the contractor is responsible for registering and maintaining an accurate and up-to-date System Security Plan in the Supplier Performance Risk System to enable continuous visibility and compliance validation by the government. The work is to be performed at a designated location with a FPO address and is classified as a subcontract under NAICS code 541512 for Other Computer Related Services. All proposal responses are due by May 5, 2026, and the contract is open for bidding through the DIBBS platform. Compliance with NIST SP 800-171 is mandatory, and failure to meet control requirements or maintain SPRS registration may result in contract noncompliance, termination, or loss of eligibility for future defense work. The contractor must have proven expertise in cybersecurity frameworks, experience with DoD subcontracting obligations, and the ability to sustain operational security posture over the lifecycle of the contract.