Cybersecurity Compliance & System Security Plan (SSP) Development

The contractor is tasked with developing and implementing a System Security Plan (SSP) that fully aligns with the technical and procedural requirements of NIST SP 800-171 and the defense subcontracting clause DFARS 252.204-7012, ensuring robust protection of Controlled Unclassified Information (CUI). This includes designing, documenting, and integrating security controls across all relevant systems and processes to meet federal cyber hygiene standards, with a strong emphasis on audit readiness and the maintenance of complete, accurate, and current documentation to demonstrate compliance during internal and external assessments. The work must be performed in support of the Department of Defense, specifically under the ASC SUPPLIER OPER OEM DIVISION, with the place of performance located at Tinker AFB, Oklahoma, 73145-8000. This is a subcontract opportunity governed under NAICS code 541611 for Management Consulting Services, and responses are due by May 21, 2026. The contractor must be prepared to establish and sustain a compliant CUI protection program, facilitate continuous monitoring of security controls, and ensure all activities are traceable and defensible under federal audit protocols.