NIST SP 800-171 Compliance Assessment & Gap Analysis

The contract requires a comprehensive evaluation of the contractor’s information systems to determine adherence to the security controls outlined in NIST Special Publication 800-171, with the goal of identifying any deficiencies or gaps in compliance. This assessment must be thorough and methodical, examining all relevant systems, processes, and procedures that handle controlled unclassified information. The findings will be documented in a Plan of Action and Milestones (POA&M), detailing each identified control shortfall, the associated risk, proposed remediation steps, timelines for resolution, and required resources. The deliverable is not merely an audit report but a strategic roadmap for achieving and maintaining compliance with federal cybersecurity standards. The work is classified as a subcontract under the NAICS code 541611 for management consulting services and is being procured by the Department of Defense through the Medical Supply Chain FSH organization. Performance is required at Fort Lewis, with a specific ZIP code designation, and all work must be completed in alignment with the solicitation deadline of May 7, 2026. The posting date indicates the opportunity was made available on April 30, 2026, suggesting a narrow window for response and preparation. The focus is strictly on compliance assessment and documentation, with no indication of implementation or remediation services being part of this engagement. Success depends on accurate identification of gaps and the clarity and completeness of the resulting POA&M to support future audits and regulatory requirements.