Cybersecurity Compliance Assessment and Reporting (NIST SP 800-171)

The contract requires the execution of a NIST SP 800-171 cybersecurity assessment on systems that handle Controlled Unclassified Information, with a focus on evaluating the implementation of required security controls and documenting compliance measures. The provider must conduct a thorough review of technical and administrative safeguards, assess gaps in current practices, and ensure alignment with NIST standards designed to protect CUI in nonfederal systems. This includes verifying that policies, procedures, and technical configurations meet the 110 security controls outlined in the framework and that all findings are accurately recorded. The successful offeror is obligated to compile and submit comprehensive compliance data to the Department of Defense’s Supplier Performance Risk System, ensuring transparency and accountability in meeting federal cybersecurity requirements. Performance is tied to the location of Camp Pendleton, California, with a submission deadline of May 18, 2026, and the solicitation was posted on May 10, 2026. The contract is classified as a subcontract under NAICS code 541611, indicating it involves management, scientific, and technical consulting services, and is issued under the Medical Supply Chain MD Surg FSF with oversight from the Department of Defense.