NIST SP 800-171 Compliance Assessment and Reporting

The contract requires comprehensive cybersecurity assessments aligned with NIST SP 800-171 controls for systems handling Controlled Unclassified Information and Covered Defense Information. Tasks include conducting detailed gap analyses to identify compliance deficiencies, developing full System Security Plans, and implementing remediation recommendations to address identified weaknesses. All findings must be validated through verification of control implementation and reported accurately to the Supplier Performance Risk System to document compliance scores. The work is focused on ensuring robust security posture for systems at Cannon AFB, where the performance location is designated, and must adhere to Defense Department standards for information protection. The subcontract is issued under NAICS code 541611 and is tied to the Medical Supply Chain MD Surg FSF under the Department of Defense, with a deadline for responses set for May 18, 2026. Although the solicitation number and point of contact are not provided, the contract seeks specialized cyber services to meet federal cybersecurity mandates, with deliverables centered on documentation, assessment, and reporting rather than technical implementation. The emphasis is on thorough evaluation, accurate reporting, and continuous validation of controls to meet regulatory requirements for handling sensitive defense data.