Cybersecurity Implementation and System Security Plan (SSP) Development

The contract requires the development and ongoing maintenance of a System Security Plan (SSP) to ensure the protection of Covered Defense Information (CDI) in alignment with NIST SP 800-171 security controls. All implementation efforts must fully comply with the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which mandates specific cybersecurity requirements for handling sensitive government data. The contractor is responsible for documenting, implementing, and continuously monitoring controls to safeguard CDI against unauthorized access, disclosure, or compromise, ensuring operational readiness and regulatory adherence throughout the contract lifecycle. In addition to SSP development, the contractor must establish and sustain processes for reporting compliance status through the Supplier Performance Risk System (SPRS), providing accurate and timely data to demonstrate adherence to NIST 800-171 requirements. The work is scoped as a subcontract under the Department of Defense, categorized under NAICS code 541512 for computer systems design services, and is tied to the Maritime Supply Chain ESOC Buys organization. The solicitation closes on July 3, 2026, with performance expected to occur in support of federal defense infrastructure, though the specific location of performance is not designated. Compliance is non-negotiable and will be subject to ongoing evaluation and audit.