Cybersecurity Compliance Implementation (NIST SP 800-171)

The contract requires the implementation, assessment, and documentation of NIST SP 800-171 security controls for systems that process, store, or transmit Controlled Unclassified Information (CUI). This includes the development of a comprehensive System Security Plan (SSP) that details how each control is satisfied or mitigated, as well as the preparation and submission of an accurate Scored Profile Reporting System (SPRS) assessment to demonstrate compliance. All activities must align with federal requirements for protecting CUI and must be thoroughly documented to support audit readiness and ongoing compliance oversight. The work is structured as a subcontract under the Department of Defense, specifically managed by the Medical Supply Chain FSH, with performance scheduled to occur at APO, ZIP 96260-5479. The solicitation falls under NAICS code 541512 for Computer Systems Design Services and is open for responses until May 20, 2026, with a posting date of May 13, 2026. Compliance with all NIST controls is mandatory, and deliverables must reflect current, accurate, and actionable security posture documentation to meet federal cybersecurity standards for defense-related contractors handling sensitive information.