NIST SP 800-171 Compliance Assessment and Reporting

The contract involves conducting comprehensive cybersecurity assessments focused on compliance with NIST SP 800-171 controls for systems that handle Controlled Unclassified Information (CUI) and Covered Defense Information (CDI). Key activities include performing gap analyses to identify deficiencies, developing detailed System Security Plans (SSPs), providing recommendations for remediation, and validating the effectiveness of implemented controls. Additionally, the contractor is responsible for reporting compliance scores to the Supplier Performance Risk System (SPRS). Issued by the Department of Defense’s Medical Supply Chain MD SURG FSF, the subcontract is targeted at the Cannon Air Force Base location, with a response deadline set for May 18, 2026. The contract falls under the NAICS code 541611, covering administrative management and general management consulting services. This effort is critical in ensuring that defense supply chain systems meet stringent cybersecurity requirements to protect sensitive information.