DFARS 252.204-7020 Assessment Execution & SPRS Submission Support

The contract requires execution of a formal NIST SP 800-171 assessment at Basic, Medium, or High level to evaluate cybersecurity controls within the contractor’s systems, ensuring alignment with Department of Defense requirements for protecting controlled unclassified information. The assessment must include a detailed analysis of control implementation status and identification of any gaps or deficiencies, followed by the documentation of remediation plans and corrective actions to address identified weaknesses. All findings and supporting evidence must be formally submitted to the Supplier Performance Risk System, as mandated by DFARS 252.204-7020, to enable government visibility into supplier cybersecurity posture and risk mitigation efforts. This work is performed under a subcontract and is tied to a specific procurement under the NAICS code 541611, indicating services related to administrative management and general management consulting. The solicitation is issued by the Department of Defense through the ASC SUPPLIER OPER AE AND AF DIV, with the performance location unspecified and no set-aside classification applied. While no point of contact or physical address is provided, the full solicitation can be accessed via the DIBBS platform, and responses are due by May 21, 2026. The contractor must ensure timely and accurate submission to SPRS, as failure to comply may impact eligibility for future DoD contracts and trigger risk-based evaluations. All deliverables, including assessment reports and corrective action plans, must meet NIST standards and be presented in a format that supports federal review and auditability.