NIST SP 800-171 Compliance Assessment and Reporting

The contract requires conducting a basic assessment of defense contractor information systems to ensure compliance with NIST SP 800-171 Revision 1, focusing on the protection of controlled unclassified information. This includes developing a comprehensive System Security Plan that outlines security controls and procedures, performing a detailed compliance scoring analysis to evaluate adherence to the required standards, and reporting critical dates related to implementation and remediation efforts. The work directly supports the Defense Federal Acquisition Regulation Supplement clause 252.204-7020, which mandates that contractors handling controlled unclassified information implement specific cybersecurity practices. The assessment must be thorough, accurate, and aligned with federal guidelines to meet DoD expectations for safeguarding sensitive data. The assignment is structured as a subcontract under the Medical Supply Chain FSH organization within the Department of Defense, with performance taking place in Bethesda, Maryland, at the zip code 20889-5600. The NAICS code 541611 indicates the work falls under management consulting services, suggesting the contractor will provide expert advising and documentation rather than direct technical implementation. The solicitation was posted on May 12, 2026, and responses are due by May 19, 2026, indicating a tight turnaround for submission. The effort is critical for maintaining contractual compliance and ensuring the defense supply chain meets federally mandated cybersecurity thresholds.