NIST SP 800-171 Compliance Assessment and Reporting

The contract requires a thorough evaluation of a Department of Defense contractor’s information systems to ensure full compliance with NIST SP 800-171 Rev. 1 standards for protecting controlled unclassified information. This assessment involves analyzing security controls across the contractor’s infrastructure, identifying gaps, and validating implementation effectiveness. A comprehensive System Security Plan must be developed to document the current security posture, control implementation, and remediation plans, ensuring alignment with all 110 requirements outlined in the NIST guideline. The final deliverable includes the submission of the completed SSP to the Supplier Performance Risk System, which will be used by the DoD to assess and manage the contractor’s cybersecurity risk profile. The work is scoped as a subcontract under NAICS code 541611, with performance required at Anniston, Alabama, and responses due by May 13, 2026.