NIST SP 800-171 Compliance Assessment and Implementation

The contract requires a comprehensive evaluation of the contractor’s System Security Plan against the specific controls outlined in NIST SP 800-171 Rev 1 to ensure alignment with federal cybersecurity standards for protecting controlled unclassified information. The assessment must systematically identify all gaps in current security practices, document findings, and provide actionable guidance to support the remediation of deficiencies. The ultimate goal is to achieve full compliance, which will be formally validated through submission of the assessment results to the Supplier Performance Risk System. This work is critical for maintaining eligibility to handle sensitive government data and is tied to a subcontract under the Department of Defense’s Medical Supply Chain program. All activities are to be performed at the designated place of performance in FPO, with submissions due no later than May 18, 2026.