NIST SP 800-171 Compliance Assessment & Gap Analysis

The contract requires a thorough evaluation of a defense contractor’s System Security Plan to ensure alignment with NIST SP 800-171 security controls, focusing on identifying deficiencies in implementation across all required control families. The assessment must examine the contractor’s current practices, policies, and technical safeguards to determine compliance with federal standards for protecting controlled unclassified information, with particular attention to areas where gaps or vulnerabilities exist. The deliverable includes a detailed analysis of non-compliance issues alongside actionable, prioritized remediation strategies that address technical, procedural, and administrative shortcomings. The work is performed as a subcontract under the Department of Defense, specifically for the ASC Commodities Division, with performance based at New Cumberland, Pennsylvania, 17070-5002. The solicitation was posted on May 13, 2026, and responses are due by May 21, 2026, under NAICS code 541611 for management consulting services. The effort demands expertise in defense cybersecurity frameworks, experience with NIST controls, and the ability to communicate findings clearly to technical and leadership stakeholders. The goal is to enable the contractor to achieve and maintain full compliance while strengthening its overall security posture against evolving threats.