NIST SP 800-171 Compliance Assessment and Reporting

The contract requires a comprehensive evaluation of a contractor’s cybersecurity posture in alignment with NIST SP 800-171 controls, focusing on the implementation and effectiveness of safeguarding controlled unclassified information. The deliverables include a detailed System Security Plan, a scored assessment report quantifying compliance gaps, and a Plan of Action and Milestones outlining remediation steps, all to be submitted either through the Supplier Performance Risk System or via written documentation. The assessment must be thorough, identifying deficiencies and providing actionable recommendations to achieve full compliance. Rebuttal support is also included as a required service should the contractor challenge findings or seek clarification on assessment results, ensuring transparency and accuracy in the evaluation process. The work is scoped under a subcontract with a performance location at FPO, 96698, and is tied to a Department of Defense initiative managed by the Medical Supply Chain Pharm FSA under NAICS code 541611, with proposals due by May 18, 2026.