Cybersecurity Compliance for Medical Devices (NIST SP 800-171)

The contract requires the implementation and assessment of NIST Special Publication 800-171 security controls to protect controlled unclassified information on connected medical devices and associated contractor systems. This effort focuses on ensuring compliance with federal cybersecurity standards for handling sensitive data within a defense context, specifically targeting systems that interact with or support medical device operations. The scope includes evaluating existing security measures, applying required controls, and validating adherence through documented assessments to mitigate risks to CUI stored, processed, or transmitted on these platforms. This is a total small business set-aside subcontract under NAICS code 541512, indicating it is reserved exclusively for small businesses to perform cybersecurity services for the Department of Defense, managed by the W40M MRC0 West office. The performance location is designated as Colorado Springs, with a strict response deadline of July 7, 2026. The work demands technical expertise in NIST 800-171 frameworks, experience with medical device cybersecurity, and the ability to deliver audit-ready documentation demonstrating full compliance. There is no specified point of contact listed, and the contract is posted through the SAM.gov platform for small business eligible contractors to respond before the deadline.