Cybersecurity Compliance Assessment and System Security Plan Development

The contract requires the performance of a comprehensive cybersecurity assessment aligned with NIST SP 800-171 Revision 1 standards to ensure the protection of Controlled Unclassified Information CUI within the systems managed by the Department of Defense. The scope includes evaluating existing security controls, identifying gaps, and documenting all applicable measures to meet federal compliance requirements. A detailed System Security Plan must be developed or updated to reflect the current security posture, incorporating policies procedures and technical safeguards necessary to safeguard CUI. This plan must comprehensively capture the implementation status of all 110 security controls outlined in the NIST framework and be maintained as a living document to support ongoing compliance. In addition to the SSP development the contract mandates preparation and submission of the Supplier Performance Risk System SPRS questionnaire to formally attest to cybersecurity readiness and compliance. The assessment and documentation efforts must be completed within the specified timeframe with responses due by May 5 2026 under the subcontract type and NAICS code 541611 for Administration of Health Programs. The place of performance is designated as FPO with zip code 96694 and the work directly supports the Medical Supply Chain PHSA under the broader authority of the Department of Defense. All deliverables must be accurate complete and submitted in accordance with federal cybersecurity compliance protocols to ensure the contractor’s eligibility to handle CUI within the Defense supply chain infrastructure.