NIST SP 800-171 Compliance Assessment and SPRS Reporting

The contract requires the execution of a NIST SP 800-171 Rev 1 cybersecurity assessment to ensure compliance with Department of Defense regulations, specifically DFARS 252.204-7012 and 252.204-7020, which govern the protection of controlled unclassified information in nonfederal systems. This includes developing a comprehensive System Security Plan that documents the implemented security controls, risk management strategies, and operational procedures to safeguard sensitive data. The completed assessment and SSP must be submitted to the Supplier Performance Risk System to demonstrate compliance and maintain eligibility for DoD contracts. The work must be performed at Fort Lewis, WA, with a zip code of 98433-9500, and the task is structured as a subcontract under the NAICS code 541611 for management consulting services. The solicitation was posted on April 30, 2026, and responses are due by May 6, 2026, indicating a tight turnaround for compliance activities. The contracting entity is the Medical Supply Chain MD Surg FSF under the Department of Defense, and all deliverables must align precisely with federal cybersecurity standards to avoid contract noncompliance and potential penalties.