Cybersecurity Compliance Assessment and Reporting

The contract requires the performance of comprehensive cybersecurity compliance assessments aligned with NIST Special Publication 800-171 standards, focusing on evaluating the security posture of systems handling controlled unclassified information. This includes the development and maintenance of detailed System Security Plans that document policies, procedures, and controls necessary to meet federal cybersecurity requirements. All assessments, plans, and findings must be submitted to the Supplier Performance Risk System, ensuring transparency and accountability across the Department of Defense supply chain. The scope further mandates ongoing periodic updates and reassessments to maintain compliance as systems evolve or new threats emerge, requiring continuous monitoring and adaptation of security measures. The work is conducted under a subcontract issued by the Defense Logistics Agency, part of the Department of Defense, and falls under the NAICS code 541611 for management, scientific, and technical consulting services. While the specific location of performance is not detailed, the deliverables are centralized within the federal cybersecurity reporting framework, requiring strict adherence to timelines and documentation standards. The contract emphasizes sustained compliance over time, not just initial assessment, ensuring that security controls remain effective and up to date throughout the lifecycle of the assessed systems.