NIST SP 800-171 Compliance Assessment and SPRS Reporting

The contract requires a comprehensive assessment of the contractor’s information systems to verify alignment with NIST SP 800-171 security requirements, focusing on the identification, documentation, and validation of implemented controls designed to protect controlled unclassified information. The assessment must result in a detailed system security plan outlining control implementation, a compliance roadmap with actionable steps for any gap remediation, and a finalized security score that quantifies the level of adherence to the framework. All deliverables are to be formally submitted to the Department of Defense’s Supplier Performance Risk System to ensure visibility and accountability across the defense supply chain. The work is to be performed at a location in Las Vegas with a zip code of 89165-1953, under a subcontract structure, and must be completed by the response deadline of May 18, 2026. The North American Industry Classification System code 541611 indicates this effort falls within management, scientific, and technical consulting services, specifically aligned with information technology and cybersecurity advisory activities. The contracting activity is managed by the Department of Defense through the Medical Supply Chain MD Surg FSF office, emphasizing the critical nature of securing sensitive data within military medical logistics systems.