NIST SP 800-171 Compliance Assessment and SPRS Reporting

The contract requires the performance of a comprehensive NIST SP 800-171 cybersecurity assessment to evaluate compliance with federal requirements for protecting controlled unclassified information within nonfederal systems. The vendor must develop a detailed System Security Plan that documents policies, procedures, and controls in place to meet NIST standards, conducting a thorough gap analysis to identify deficiencies and then creating a remediation plan to address each identified weakness. All findings, including the completed SSP and remediation strategy, must be formally submitted to the Supplier Performance Risk System to ensure visibility and compliance tracking within the Department of Defense supply chain. The work is scoped as a subcontract under NAICS code 541611 and is set to be performed at New Cumberland, Pennsylvania, with responses due by July 27, 2026, following a posting date of July 22, 2026. The contracting entity is the ASC SUPPLIER OPER AE AND AF DIV under the Department of Defense, emphasizing the critical nature of securing controlled technical information across defense contractor systems.