Cybersecurity Compliance (NIST SP 800-171) & SPRS Reporting

The contract requires the performance of a NIST SP 800-171 cybersecurity assessment to evaluate compliance with federal standards for protecting Controlled Unclassified Information CUI. The contractor must develop a comprehensive System Security Plan SSP that documents security controls, policies, and procedures aligned with NIST guidelines. All findings from the assessment must be reported to the Supplier Performance Risk System SPRS, including a detailed Plan of Action and Milestones POA&M that outlines identified deficiencies, corrective actions, timelines, and responsible parties. The work must be performed in Johnston, Iowa 50131-1824 under a subcontracting arrangement within the Department of Defense supply chain, specifically supporting the Aviation Supply Chain ESOC Buys office. The solicitation was posted on May 12 2026 with responses due by May 20 2026 under NAICS code 541618 for other scientific and technical consulting services.