Medical Device Cybersecurity Compliance Assessment

The contract requires performing NIST SP 800-171 Revision 1 compliance assessments on medical devices that handle Controlled Unclassified Information, ensuring alignment with federal cybersecurity standards for protecting sensitive data. Tasks include developing detailed system security plans, evaluating and quantifying risk scores based on identified vulnerabilities, and submitting formal reports to the Department of Defense’s Supplier Performance Risk System. The work must be carried out on devices within the medical supply chain, with performance taking place at APO, 09227-0000, and is structured as a subcontract under the NAICS code 541611 for administrative management and general management consulting services. All documentation and reporting must adhere strictly to DoD requirements, and responses are due by May 18, 2026.