NIST SP 800-171 Compliance Assessment & Reporting

The contract requires a comprehensive cybersecurity assessment aligned with NIST SP 800-171 Rev 1 to evaluate the implementation of security controls within the organization's information systems. The assessment must document all relevant controls, calculate a compliance score based on the findings, and produce a System Security Plan summary that outlines the current state of security posture. The results must be formally submitted to the Department of Defense’s Supplier Performance Risk System to ensure visibility and tracking within the defense supply chain. Key deliverables include the organization’s CAGE code, the assessed compliance level, the calculated score, and a projected date for full compliance, which will support decision-making and risk management efforts by the contracting entity. The work is performed under a subcontract classified under NAICS code 541611, with performance location designated as FPO, ZIP 96534-2200, indicating operations may involve overseas or military logistics environments. The solicitation was posted on June 25, 2026, with a strict response deadline of June 30, 2026, necessitating prompt and accurate execution. The contracting activity is managed by the Maritime Supply Chain ESOC Buys under the Department of Defense, emphasizing the critical role of cybersecurity adherence for defense contractors handling controlled unclassified information. Compliance is not optional, and accurate reporting is required to maintain eligibility for future defense contracts and uphold the integrity of the defense industrial base.