NIST SP 800-171 Compliance Assessment and Scoring

The contract requires a detailed evaluation of a contractor’s information systems to determine adherence to the security controls outlined in NIST Special Publication 800-171. This assessment involves scrutinizing technical and managerial safeguards related to the protection of controlled unclassified information, ensuring alignment with federal cybersecurity standards. A compliance score will be calculated based on the degree to which each control is implemented and effectively operating, with scoring methodologies designed to reflect real-world risk and operational maturity. The evaluation must be systematic, thorough, and documented to support objective analysis and decision-making. The final deliverable includes comprehensive documentation prepared for submission to the Supplier Performance Risk System, a Department of Defense platform used to track supplier cybersecurity posture. The work is to be performed at Quantico, Virginia, with all activities requiring strict adherence to federal contracting guidelines. The solicitation is classified as a subcontract under NAICS code 541611, pertaining to management consulting services, and has a narrow window for response, closing on May 15, 2026. The effort is part of the broader Defense Supply Chain Security initiative, emphasizing the critical need for consistent and verifiable cybersecurity practices across defense contractors.