NIST SP 800-171 Compliance Assessment and Scoring

The contractor is required to perform a formal assessment of their information system to determine compliance with the National Institute of Standards and Technology Special Publication 800-171 requirements, which govern the protection of controlled unclassified information in nonfederal systems. The assessment must evaluate the implementation of all 110 security controls outlined in the publication, generate a comprehensive summary score reflecting the level of compliance, and clearly identify any deficiencies or gaps in implementation. The resulting analysis must be documented in a manner that supports accurate and timely submission to the Supplier Performance Risk System, a Department of Defense platform used to track contractor cybersecurity posture and risk. The evaluation must be thorough, impartial, and aligned with federal standards to ensure the integrity of the scoring and reporting process. This subcontract is issued under NAICS code 541611 and the place of performance is specified as San Antonio, Texas, with a 78226 ZIP code. The solicitation was posted on May 10, 2026, and responses are due no later than May 18, 2026, giving contractors approximately eight days to prepare and submit their proposals. The contracting activity originates from the Department of Defense under the Medical Supply Chain FSH organization, indicating the assessment targets entities involved in defense-related medical supply systems. Successful completion of this task is critical for maintaining access to government contracts, as SPRS scores directly impact a supplier’s risk profile and eligibility for future awards.