NIST SP 800-171 Compliance Assessment and Reporting

The contract requires a comprehensive assessment of information systems to ensure compliance with NIST SP 800-171 standards, focusing on the protection of controlled unclassified information. This includes developing a detailed System Security Plan that outlines controls, procedures, and risk mitigation strategies aligned with the NIST framework. The contractor must also document the full system architecture, including hardware, software, network configurations, and data flows, to provide a clear understanding of the security environment. Assigning appropriate CAGE codes to the system components is a required step for proper identification and tracking within federal systems. All findings, documentation, and certifications must be submitted to the Department of Defense Supplier Performance Risk System to meet federal reporting obligations. The work is scoped as a subcontract under the Department of Defense, specifically managed by the ASC SUPPLIER OPER OEM DIVISION, with performance required at Jacksonville, Florida, 32212-0103. The North American Industry Classification System code is 541611, indicating services in administrative management and general management consulting. The solicitation was posted on May 12, 2026, with a firm response deadline of May 20, 2026, leaving a narrow window for proposals. While no specific set-aside provisions are indicated, the requirement is tied to a DoD procurement and expects full adherence to federal cybersecurity standards. Failure to meet the documentation, assessment, or submission requirements will result in non-compliance and potential disqualification.