NIST SP 800-171 Compliance Assessment & Reporting

The contract requires a comprehensive cybersecurity assessment of contractor systems that handle Controlled Unclassified Information, aligned with the requirements outlined in NIST SP 800-171 Revision 1. The assessment must evaluate the implementation of security controls defined in the standard and result in a formal scored report that documents compliance status across all applicable families and controls. This deliverable must be submitted to the DoD Supplier Performance Risk System to meet federal contractual obligations for defense contractors handling CUI. The work is classified as a subcontract under NAICS code 541611 and is being managed by the Department of Defense under the Medical Supply Chain FSH organization. The place of performance is designated as APO, ZIP 96278-2060, indicating a military postal address, likely supporting overseas or mobile operations. The solicitation was posted on May 10, 2026, with a firm response deadline of May 18, 2026, requiring prompt technical and operational readiness from proposers. The contract emphasizes strict adherence to NIST guidelines and timely reporting to ensure defense supply chain security and compliance with federal cybersecurity mandates.