Cybersecurity Compliance – NIST SP 800-171 Self-Assessments

The contract requires the contractor to perform comprehensive self-assessments of their information systems to ensure compliance with NIST Special Publication 800-171 requirements for protecting Controlled Unclassified Information. This includes developing thorough System Security Plans that document security controls, policies, and procedures aligned with the NIST framework. All assessment findings and supporting documentation must be submitted through the Supplier Performance Risk System to satisfy Defense Federal Acquisition Regulation Supplement obligations. The work must be completed within a tight window, with responses due by May 5, 2026, and is designated as a subcontract under the NAICS code 541611 for management consulting services. The performance location is listed as APO with zip code 96543-4010, indicating operations may involve overseas or military logistics environments, and the contracting entity is part of the Department of Defense’s Medical Supply Chain.