Medical Device Cybersecurity Compliance (NIST SP 800-171 Implementation)

This contract focuses on the development and ongoing maintenance of a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M) aimed at ensuring compliance with the NIST SP 800-171 cybersecurity standards. The objective is to protect Controlled Unclassified Information (CUI) within the Department of Defense's medical supply chain environment, specifically related to medical devices. The work involves detailed documentation and continuous updates to safeguard sensitive information in alignment with federal cybersecurity requirements. The subcontract, identified under the NAICS code 541611, is issued by the Department of Defense through the Medical Supply Chain MD Surg FSF office, with the place of performance in Raleigh, North Carolina (ZIP code 27607). The solicitation was posted on May 11, 2026, with proposals due by May 18, 2026. This project is crucial for maintaining robust information security controls in the defense medical supply sector, ensuring the integrity and confidentiality of critical health-related data throughout the supply process.