Medical Device Cybersecurity Compliance (NIST SP 800-171 Implementation)

The contract focuses on the development and ongoing maintenance of a System Security Plan and Plan of Action and Milestones to achieve full compliance with NIST Special Publication 800-171 for the protection of Controlled Unclassified Information within a Department of Defense medical supply environment. The work will ensure that all systems handling CUI meet federal cybersecurity standards, specifically tailored to the unique risks and operational demands of medical device and supply chain infrastructure. This includes identifying security controls, documenting implementation status, tracking remediation efforts, and maintaining continuous alignment with evolving NIST requirements to safeguard sensitive data across the lifecycle of medical equipment and associated systems. Performance is required to be executed in Raleigh, North Carolina, with a designated response deadline of May 18, 2026, and the solicitation was posted on May 11, 2026. The contract is classified as a subcontract under NAICS code 541611, indicating it involves scientific and technical consulting services related to cybersecurity compliance. The primary objective is to support the Medical Supply Chain MD Surg FSF in maintaining operational readiness and regulatory adherence by implementing robust, documented, and auditable cybersecurity practices that mitigate risks to CUI throughout the defense medical logistics ecosystem.