Cybersecurity Compliance Assessment and SPRS Reporting

The contract requires performing a comprehensive cybersecurity compliance assessment in accordance with NIST SP 800-171 Revision 1 to evaluate the controlled unclassified information (CUI) protection measures of a contractor’s information system. The assessment must include a detailed evaluation of all 110 security requirements outlined in the standard, resulting in a documented score that reflects the level of compliance. All findings, evidence, and supporting documentation must be compiled and formally submitted to the Supplier Performance Risk System (SPRS) to update the organization’s cybersecurity posture rating as required by Department of Defense procurement policies. This activity is critical for maintaining eligibility to perform on sensitive government contracts and ensuring alignment with federal cybersecurity standards. The work is structured as a subcontract under the Department of Defense’s ASC Commodities Division, with performance expected to be delivered from the FPO address with ZIP code 96675. The solicitation was posted on May 11, 2026, and responses are due by May 19, 2026, indicating a narrow window for submission. The North American Industry Classification System code 541618 designates this as an information technology consulting service, reinforcing the technical and evaluative nature of the required deliverables. Failure to properly complete and submit the assessment and documentation to SPRS may result in adverse contract performance ratings and loss of future business opportunities with defense agencies.