NIST SP 800-171 Compliance Assessment and Reporting

The contract requires a comprehensive evaluation of a contractor's information systems to ensure full alignment with the security controls outlined in NIST SP 800-171 Revision 1, focusing on the protection of controlled unclassified information. The assessment must systematically examine all relevant technical, administrative, and physical safeguards, identify gaps or noncompliance areas, and produce detailed documentation of the findings. The resulting reports must be thoroughly vetted and formatted for immediate submission to the Department of Defense’s Supplier Performance Risk System, ensuring accurate representation of the contractor’s security posture. The work must be performed on schedule with a response deadline of May 5, 2026, and is classified as a subcontract under NAICS code 541611. Performance will occur at APO 96260-5479, under the auspices of the Medical Supply Chain MD Surg FSF within the Department of Defense. The deliverables are mission-critical, directly influencing the contractor’s eligibility to support DoD supply chain operations, and must reflect strict adherence to federal cybersecurity standards without deviation. Timing, accuracy, and completeness of reporting are paramount to meet program requirements and maintain compliance.