NIST SP 800-171 Compliance Assessment & Reporting

A NIST SP 800-171 compliance assessment is required for Department of Defense contractor systems that handle Controlled Unclassified Information, with the goal of evaluating the implementation of security controls, documenting all relevant measures, and calculating an overall compliance score. The contractor must identify gaps in current security practices against the NIST framework and develop a detailed Plan of Action and Milestones to address deficiencies and achieve full compliance. The assessment must be thorough, methodical, and aligned with DoD requirements for safeguarding CUI within subcontracted environments. The work is to be performed at New Cumberland, Pennsylvania, with a response deadline of July 21, 2026, and is classified as a subcontract under NAICS code 541611. The solicitation is managed by the ASC SUPPLIER OPER AE AND AF DIV under the Department of Defense, and all deliverables must be completed in accordance with applicable federal cybersecurity standards. The contractor is expected to deliver a comprehensive report that clearly outlines current control status, risks, remediation timelines, and actionable steps to ensure the system meets all NIST SP 800-171 requirements.