NIST SP 800-171 Compliance Assessment and Scoring

The contract requires a comprehensive evaluation of the contractor’s information systems to ensure full alignment with NIST SP 800-171 Rev 1 standards for protecting controlled unclassified information. This includes conducting a detailed assessment of all relevant security controls, identifying gaps in current practices, and developing a complete System Security Plan that outlines policies, procedures, and technical safeguards in accordance with the framework. The assessment must result in a quantifiable compliance score derived from the findings, reflecting the extent to which the system meets each requirement specified in the NIST publication. All documentation generated must be formatted and structured to facilitate seamless submission to the Supplier Performance Risk System, ensuring transparency and accuracy in the reporting process. The work is to be performed at Williamsburg, Virginia, with a strict deadline for response by May 6, 2026, under a subcontract arrangement managed by the Department of Defense through the Medical Supply Chain MD Surg FSF.