NIST SP 800-171 Compliance Assessment & SPRS Reporting

The contract requires the performance of NIST SP 800-171 Rev 1 compliance assessments to evaluate an organization’s adherence to cybersecurity requirements for protecting controlled unclassified information. The assessments must include scoring the results according to established criteria and submitting those scores to the Supplier Performance Risk System (SPRS) as mandated by federal contracting guidelines. Any findings from the assessments must be properly documented, managed, and addressed through remediation plans, with particular attention given to ensuring compliance flow-down requirements are met across all subcontractors involved in the work. The contractor is also responsible for timely cyber incident reporting in accordance with applicable regulations, ensuring that any breaches or security events are identified, escalated, and reported without delay to maintain regulatory compliance and safeguard sensitive data. Work under this subcontract is to be performed at the specified location in New Cumberland, Pennsylvania, with a tight response deadline of July 21, 2026, and is classified under NAICS code 541611 for management, scientific, and technical consulting services.