NIST SP 800-171 Compliance Assessment and Gap Analysis

The contract requires a thorough evaluation of the prime contractor’s information systems to determine adherence to NIST Special Publication 800-171 standards, focusing on identifying any deficiencies or gaps in security controls designed to protect controlled unclassified information. The assessment must be comprehensive, examining all relevant systems, policies, and procedures to ensure alignment with the specified framework, and must result in a detailed gap analysis that clearly outlines areas of noncompliance along with their risk implications. Following the assessment, a remediation roadmap must be developed to guide the prime contractor through actionable, prioritized steps to achieve full compliance. This roadmap should include specific recommendations, timelines, resource requirements, and measurable outcomes, ensuring the organization can systematically address each identified deficiency. The work is classified as a subcontract under NAICS code 541611, with performance duties centered in Tracy, California, and responses due by May 18, 2026, under the solicitations managed by the Department of Defense’s ASC Commodities Division.