Cybersecurity Compliance Implementation & NIST SP 800-171 Assessment

The contract requires full implementation of NIST SP 800-171 security controls to ensure compliance with Department of Defense requirements for protecting controlled unclassified information. This includes developing a comprehensive System Security Plan that documents all security measures, policies, and procedures aligned with NIST standards, as well as conducting a SPRS assessment to evaluate and report the organization’s cybersecurity posture. The work is focused on achieving audit readiness for a DoD review, meaning all technical, administrative, and physical controls must be properly configured, tested, and documented to meet federal mandates. The place of performance is designated as Tracy, California, with the work falling under NAICS code 541611 for Management, Scientific, and Technical Consulting Services, and is structured as a subcontract under the Aviation Supply Chain organization. All activities must be completed and submitted by the response deadline of May 18, 2026, with the solicitation posted on May 10, 2026, indicating a tight turnaround window for proposal preparation. The contractor is expected to deliver a fully compliant environment ready for external DoD audit, with no allowance for non-conformance in CUI handling or control implementation. While no set-aside type is specified, the effort is targeted toward organizations with proven expertise in defense cybersecurity frameworks and documentation standards. The successful bidder must demonstrate prior experience in NIST SP 800-171 assessments, SSP development, and SPRS scoring, with the ability to operate efficiently under the constraints of a subcontract arrangement within a critical defense supply chain environment.