Cybersecurity Compliance and System Security Planning (SSP)

The contract requires the development and submission of a System Security Plan (SSP) that fully complies with NIST SP 800-171 standards to ensure the protection of Controlled Unclassified Information (CUI). This is a subcontract under the Department of Defense, specifically managed by the ASC SUPPLIER OPER OEM DIVISION, and the work must be performed at a military postal address in FPO with ZIP code 96694-2900. The SSP must outline technical, administrative, and physical safeguards to meet all NIST controls applicable to CUI handling, demonstrating a robust cybersecurity posture aligned with federal requirements. The response deadline is May 20, 2026, and the solicitation falls under NAICS code 541611, which pertains to computer systems design and related services, indicating the need for specialized cybersecurity expertise. The contract is issued as a subcontract, meaning the provider must align their SSP with the prime contractor's broader cybersecurity framework and may be subject to additional downstream compliance obligations. Although no point of contact or set-aside details are provided, the emphasis on NIST SP 800-171 compliance signals strict adherence to federal cybersecurity mandates, requiring documented policies, access controls, incident response procedures, and continuous monitoring of CUI environments. The provider must ensure complete documentation of all security controls, implementation status, and any deviations or compensating measures, with the plan submitted for review and approval prior to contract award. Failure to produce a compliant SSP may result in disqualification or contract termination.