Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and assessment of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information within contractor systems, with a focus on developing a System Security Plan and a Plan of Action and Milestones to address compliance gaps. This effort is specifically tied to ensuring that all applicable cybersecurity requirements are met to protect sensitive data handled under the Department of Defense’s Medical Supply Chain MD Surg FSF. Compliance must be demonstrated through documented processes, continuous monitoring, and remediation planning aligned with federal standards for information security. The subcontract is issued under NAICS code 541612, indicating services related to management and technical consulting, and performance is expected to occur at the FPO location with ZIP code 96694. The solicitation was posted on July 23, 2026, with responses due no later than July 29, 2026, and is open to eligible subcontractors supporting DoD obligations. All work must adhere strictly to NIST guidelines, with emphasis on thorough documentation, timely identification of vulnerabilities, and measurable progress toward full compliance. There is no set-aside designation specified, and the contractor is expected to deliver actionable compliance artifacts by the deadline to meet defense supply chain security requirements.