NIST SP 800-171 Compliance & System Security Plan (SSP) Development

The contract requires the development of a System Security Plan aligned with NIST Special Publication 800-171 Rev 1 to establish and document security controls necessary for handling Controlled Unclassified Information. The scope focuses on creating a comprehensive SSP that ensures compliance with federal cybersecurity standards for protecting CUI within the contractor’s information systems. This includes identifying and implementing all required security controls, documenting system boundaries, roles, responsibilities, and procedures for ongoing compliance, and ensuring the plan is tailored to the specific environment where CUI is processed, stored, or transmitted. The work is to be performed at Cherry Point, North Carolina, under a subcontract awarded by the Department of Defense’s ASC Commodities Division. The solicitation is open for responses through May 20, 2026, with activities governed by the NAICS code 541512 for computer systems design services. All deliverables must meet NIST 800-171 Rev 1 requirements without exceptions, and the successful applicant must demonstrate experience in developing and implementing CUI protection frameworks across defense-related systems. The plan must be ready for review and audit by federal authorities and should support continuous compliance beyond initial implementation.