Cybersecurity Compliance and System Security Plan (SSP) Development

The contract requires the development and ongoing maintenance of a System Security Plan (SSP) aligned with NIST SP 800-171 and DFARS 252.204-7012 to safeguard controlled unclassified information (CUI) handled within the scope of the project. The SSP must outline organizational policies, technical controls, and procedural safeguards to ensure compliance with federal cybersecurity standards for protecting CUI on non-federal systems. This includes identifying, implementing, and documenting security controls across the entire system environment, addressing areas such as access control, audit and accountability, configuration management, incident response, and personnel security. The work is under a subcontract administered by the Department of Defense through the Medical Supply Chain MD Surg FSF, with performance located at Cherry Point, North Carolina, ZIP 28533-8051. The solicitation, issued under NAICS code 541512 for computer systems design services, has a response deadline of May 5, 2026, and the winning party will be responsible for maintaining continuous compliance as threats and regulatory requirements evolve. All deliverables must be thoroughly documented and available for audit or inspection, and the contractor must demonstrate a clear understanding of CUI handling requirements, risk assessment methodologies, and the ability to integrate security into operational workflows without disrupting mission-critical functions.