NIST SP 800-171 Compliance & Cybersecurity Assessment

This contract requires the implementation of all NIST SP 800-171 Rev 1 security controls to protect Covered Defense Information (CDI) in alignment with Department of Defense compliance requirements. The contractor must establish and maintain a robust cybersecurity posture by applying the specified controls across systems handling CDI, ensuring data integrity, confidentiality, and availability throughout the contract lifecycle. A self-assessment of the implemented controls must be conducted according to NIST guidelines, with the resulting score formally submitted to the Supplier Performance Risk System (SPRS) to demonstrate compliance status and readiness for DoD contract obligations. The work is classified as a subcontract under NAICS code 541512, with performance expected to occur at New Cumberland, Pennsylvania, 17070-5002. The solicitation was posted on May 11, 2026, and responses are due by May 19, 2026, with no set-aside provisions specified. The contracting office is part of the Department of Defense’s ASC SUPPLIER OPER AE AND AF DIV, emphasizing the critical nature of cybersecurity readiness for defense-related suppliers. Failure to meet the security control requirements or submit an accurate SPRS score will result in noncompliance and potential loss of contract eligibility.