Cybersecurity Compliance Assessment & SPRS Reporting

The contract requires the performance of a comprehensive cybersecurity compliance assessment aligned with NIST SP 800-171 standards to ensure adherence to Department of Defense requirements for handling controlled unclassified information. The vendor must conduct a thorough evaluation of existing security controls, identify gaps, and develop a complete System Security Plan that documents policies, procedures, and technical measures in place to protect sensitive data. This plan must reflect accurate and current implementation of all 110 controls specified in the NIST publication and be tailored to the specific environment and operations of the contracting organization. Upon completion of the assessment and plan development, the vendor is responsible for submitting the formal documentation to the Supplier Performance Risk System to achieve official DoD compliance status. The submission must meet all SPRS formatting and data requirements to be accepted and recorded within the system. The work is tied to a subcontract under the Medical Supply Chain MD Surg FSF, with performance required at Travis AFB, CA, 94535-1825. All deliverables must be finalized and submitted before the response deadline of May 5, 2026, ensuring timely compliance for the defense supply chain operations.