Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires the provision of comprehensive cybersecurity compliance services aligned with NIST SP 800-171 to protect Controlled Unclassified Information (CUI). This includes conducting a formal compliance assessment to evaluate current security controls, developing a detailed System Security Plan (SSP) that outlines the organization’s approach to safeguarding CUI, and creating a Plan of Action and Milestones (POA&M) to address identified gaps and remediate deficiencies. These deliverables must be thorough, actionable, and aligned with federal standards to ensure proper implementation and ongoing compliance across systems handling CUI. The work is structured as a subcontract under the Department of Defense’s Active Devices Division, with performance expected to meet strict federal cybersecurity requirements. The solicitation is open to qualified vendors who can demonstrate expertise in NIST 800-171 frameworks, CUI handling protocols, and government compliance documentation. Proposals must be submitted by May 16, 2026, and the North American Industry Classification System code 541512 indicates the scope falls under computer systems design and related services. There is no set-aside designation specified, and performance location details are not provided, suggesting flexibility or classified placement.