Cybersecurity Compliance & System Security Plan (SSP) Development

The contract requires the development and ongoing maintenance of a System Security Plan (SSP) aligned with NIST SP 800-171 standards to safeguard Controlled Unclassified Information (CUI) within the defense supply chain. The effort demands a thorough implementation of security controls covering areas such as access control, awareness training, audit and accountability, configuration management, identification and authentication, incident response, and risk assessment, all tailored to ensure full compliance with federal cybersecurity requirements. The contractor is responsible for documenting all policies, procedures, and control implementations in the SSP and must consistently update the plan to reflect changes in systems, threats, or regulatory guidance. In addition to creating and maintaining the SSP, the contractor must regularly perform assessments of security control effectiveness and submit resulting scores to the Supplier Performance Risk System (SPRS) to demonstrate ongoing compliance. The contract is structured as a subcontract under the Department of Defense, specifically tied to the Medical Supply Chain MD Surg FSF initiative, with a NAICS code of 541512 indicating it falls under Computer Systems Design Services. The solicitation window is tight, with responses due just six days after posting, signaling an urgent need for immediate action. Performance is expected to support the broader defense infrastructure by ensuring robust, auditable cybersecurity posture and continuous readiness for CUI protection across the supply chain.