Cybersecurity Compliance Assessment (NIST SP 800-171)

The contract requires the performance and submission of a NIST SP 800-171 cybersecurity assessment for systems that process, store, or transmit controlled unclassified information, ensuring compliance with federal security standards. The assessment must evaluate the implementation of required security controls outlined in the NIST publication, with the goal of demonstrating adequate protection of CUI within the contractor’s environments. The work is structured as a subcontract under the Department of Defense, specifically for the Maritime Supply Chain, with a NAICS code of 541611 indicating it falls under management, scientific, and technical consulting services. The response deadline is set for May 13, 2026, and the solicitation was posted on May 8, 2026, indicating a five-day window for submission. Performance of this contract involves a thorough review of the contractor's cybersecurity posture against the 110 controls in NIST SP 800-171, including documentation of system boundaries, data flows, and implemented safeguards. The submission must be formally documented and delivered in a format acceptable to the government, likely including a System Security Plan and a Plan of Action and Milestones. No specific location is designated for performance, suggesting the work may be conducted remotely or at the subcontractor’s facility, as long as the systems assessed are accessible for evaluation. The contractual obligation is limited to the assessment activity and does not include remediation or ongoing compliance support unless otherwise explicitly stated. All work must align with the Department of Defense’s expectations for safeguarding CUI and must be completed within the narrow response window to be considered.