Cybersecurity Compliance for CUI Handling (NIST SP 800-171)

The contract requires the execution of a cybersecurity compliance assessment aligned with NIST SP 800-171 Revision 1 to evaluate the protection of Controlled Unclassified Information (CUI) within a specified system. This includes a thorough review of existing security controls, identification of gaps in compliance, and the development of a comprehensive System Security Plan (SSP) that documents how CUI is safeguarded across all applicable domains. The assessment must ensure adherence to the 110 security requirements outlined in NIST SP 800-171, covering areas such as access control, audit and accountability, configuration management, and incident response, with the SSP serving as the official record of the organization’s cybersecurity posture. The work is to be performed at the designated place of performance in New Cumberland, Pennsylvania, under a subcontract arrangement, and must be completed by the response deadline of May 20, 2026. The solicitation falls under NAICS code 541611, indicating it is for management, scientific, and technical consulting services, and is being procured by the Department of Defense through the ASC SMSG DIV SPECIAL ACQUISITION office. While no specific set-aside provisions or point of contact are provided, the deliverables are critical for enabling CUI handling authorization and must be technically rigorous, fully documented, and ready for potential government review or audit.