Cybersecurity Compliance and Reporting (NIST SP 800-171)

This contract requires the implementation of NIST SP 800-171 security controls to ensure the protection of Controlled Unclassified Information (CUI) within the contractor’s information systems. The deliverables include the development of a comprehensive System Security Plan (SSP) that documents how these controls are applied, maintained, and monitored to meet federal cybersecurity requirements. Additionally, the contractor must achieve and maintain an accurate SPRS score reflecting compliance with NIST SP 800-171, which is essential for continued eligibility to handle CUI under Department of Defense contracts. The work is being performed as a subcontract under the Medical Supply Chain PHSA, with the place of performance located at Fort Stewart, Georgia, and must be completed by the response deadline of May 18, 2026. This effort supports the broader federal mandate to safeguard CUI across the defense supply chain and is governed under North American Industry Classification System code 541512 for computer systems design services.