Cybersecurity Compliance Assessment and Reporting

The contract requires performing a comprehensive cybersecurity compliance assessment aligned with NIST SP 800-171 standards to evaluate the current security posture of systems handling controlled unclassified information. The contractor must develop a detailed System Security Plan that documents control implementation, risk management strategies, and operational procedures to meet federal cybersecurity requirements. All findings from the assessment must be formally reported to the Supplier Performance Risk System, ensuring transparency and accountability within the Department of Defense’s supply chain ecosystem. The effort includes generating a remediation plan that identifies gaps in compliance and outlines actionable steps, timelines, and responsible parties to achieve full adherence to NIST SP 800-171 requirements. Performance is tied to the location of Perry Point, Maryland, and the work is classified as a subcontract under NAICS code 541611 for management, scientific, and technical consulting services. The solicitation was posted on May 10, 2026, with responses due by May 18, 2026, under the purview of the Medical Supply Chain FSH, a component of the Department of Defense.