NIST SP 800-171 Compliance Assessment & Gap Analysis

The contract requires a thorough evaluation of a contractor’s information systems to determine adherence to the security controls outlined in NIST Special Publication 800-171 Revision 1, with the goal of identifying any deficiencies or gaps in the implementation of those controls. This assessment is critical to ensuring the protection of controlled unclassified information within the contractor’s environment and must be conducted in alignment with federal cybersecurity standards. The work is performed as a subcontract under the Department of Defense, specifically for the Medical Supply Chain MD Surg FSF, with the performance location established at Cannon Air Force Base, New Mexico, 88101-5009. The solicitation was posted on May 10, 2026, and responses are due by May 18, 2026, indicating a tight turnaround for proposal submission. The North American Industry Classification System code 541611 applies, which corresponds to management, scientific, and technical consulting services, suggesting the work involves expert analysis and advisory capabilities rather than direct implementation. There is no set-aside designation specified, meaning the subcontract is open to all qualified entities regardless of size or ownership status. The task demands a methodical and rigorous audit approach to assess technical, administrative, and physical controls, with findings expected to inform remediation strategies and compliance readiness.