NIST SP 800-171 Compliance & Cybersecurity Assessment

The contract requires the execution of a full self-assessment against the NIST SP 800-171 security controls to evaluate compliance with cybersecurity requirements for handling controlled unclassified information. This includes identifying gaps in existing security practices, documenting the current posture, and formally developing a comprehensive System Security Plan that outlines how the organization manages and mitigates risks. Alongside the SSP, a detailed Plan of Action and Milestones must be created to address identified deficiencies, specifying corrective actions, responsible parties, timelines, and resources needed to achieve full compliance. All deliverables must be submitted to the Department of Defense’s Supplier Performance Risk System to ensure transparency and accountability in the defense supply chain. The assessment must align with DoD expectations and be completed within a strict six-day window following posting, with the place of performance tied to Prince Sultan, reflecting the operational context of the contract. Although no specific set-aside or solicitation number is listed, the NAICS code 541611 indicates this is an information technology services subcontract under the broader Department of Defense medical supply chain initiative.