Cybersecurity Compliance Assessment & Reporting

The contract requires a comprehensive cybersecurity assessment of IT systems that process Controlled Unclassified Information (CUI), aligned with the requirements of NIST SP 800-171 Rev 1. The vendor must evaluate the current security controls in place, identify gaps in compliance, and deliver a formal compliance score reflecting the system’s adherence to the standard. Alongside the score, a detailed system security plan must be produced, outlining the current state of security measures and the roadmap for achieving full compliance. A specific target compliance date must be established, providing a realistic timeline for remediation and implementation of necessary controls. All deliverables must be submitted via email in a standardized format as specified in the contract, ensuring consistency and ease of review by the procuring entity. The solicitation is issued as a subcontract under the Department of Defense’s ASC Commodities Division, with a NAICS code of 541611, indicating it falls under computer systems design services. The bid response deadline is May 18, 2026, and the opportunity was posted on May 10, 2026. While the physical place of performance is unspecified, the assessment must be conducted on systems handling CUI, and the deliverables must meet the federal government’s expectations for structured reporting and accountability.