Cybersecurity Compliance – System Security Plan (SSP) Development & Assessment

The contract requires the development, assessment, and ongoing maintenance of a System Security Plan (SSP) for contractor systems that handle Controlled Unclassified Information (CUI), ensuring full alignment with NIST SP 800-171 and DFARS regulatory requirements. The successful bidder must design a comprehensive SSP that identifies, implements, and documents security controls necessary to protect CUI across all relevant systems, with continuous monitoring and updating to reflect changes in technology, threats, or compliance standards. This includes thorough gap assessments, control implementation validation, and readiness for audits or evaluations by federal oversight bodies. Performance is expected to support systems located at Travis Air Force Base with a zip code of 94535-1825, under the oversight of the Department of Defense’s Medical Supply Chain MD Surg FSF office. The solicitation is structured as a subcontract under NAICS code 541611, indicating the work involves management, scientific, and technical consulting services focused on cybersecurity compliance. Responses are due by May 18, 2026, with the solicitation posted on May 11, 2026, requiring timely and precise submission to meet federal procurement timelines. The contractor must demonstrate proven experience in NIST 800-171 compliance, CUI handling, and SSP documentation to be considered for award.