Cybersecurity Compliance & System Security Plan (SSP) Development

The contract requires the development and documentation of a comprehensive System Security Plan (SSP) that strictly adheres to the cybersecurity controls outlined in NIST Special Publication 800-171 and the Defense Federal Acquisition Regulation Supplement (DFARS) requirements. This effort involves identifying, implementing, and documenting all necessary security controls across organizational systems to ensure compliance with federal standards for protecting Controlled Unclassified Information. In addition to the SSP, the contractor must prepare and submit a Plan of Action and Milestones (POA&M) that details existing security weaknesses, corrective actions, timelines, and resource requirements to address vulnerabilities. A thorough compliance assessment will be conducted to validate that all required controls are properly implemented and functioning as intended, with results providing a clear audit trail for government review. The work is structured as a subcontract under the Department of Defense’s Active Devices Division, with performance expected to meet rigorous defense cybersecurity benchmarks. The solicitation, posted on April 24, 2026, closes for responses on May 8, 2026, and falls under NAICS code 541611 for management, scientific, and technical consulting services. While no specific location is designated for performance, compliance with DoD standards is mandatory regardless of geographic placement. The contractor must demonstrate proven expertise in NIST 800-171 implementation, risk management within federal contracting environments, and the ability to produce audit-ready documentation that withstands scrutiny during government assessments.