NIST SP 800-171 Compliance Assessment and Implementation

The contract requires the execution of a complete self-assessment and implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information within the provider’s systems. This includes developing a comprehensive System Security Plan, mapping existing controls to the NIST requirements, identifying and remediating any gaps in compliance, and submitting the final assessment results through the Supplier Performance Risk System. The work must be carried out to ensure full alignment with federal standards for protecting CUI, with particular focus on technical, administrative, and physical safeguards outlined in the framework. The task is structured as a subcontract under the Defense Logistics Agency, part of the Department of Defense, and falls under the NAICS code 541512 for computer systems design services. The engagement is set to begin on July 31, 2026, with performance expected to meet strict compliance deadlines. The provider must demonstrate capability in cybersecurity governance, documentation rigor, and remediation planning to achieve and sustain NIST 800-171 compliance, with all outputs subject to verification by the DLA. There is no specified set-aside designation or geographic restriction for performance, but success hinges on thorough and accurate execution across all required milestones.