NIST SP 800-171 Compliance Assessment and SPRS Reporting

The contract involves performing a thorough evaluation of the contractor’s information systems to ensure compliance with the cybersecurity standards outlined in NIST SP 800-171 Revision 1. The scope includes identifying any deficiencies or gaps in adherence to these requirements and submitting a detailed assessment report to the Department of Defense's Supplier Performance Risk System (SPRS) database. Additionally, the contractor must develop and include a Plan of Action and Milestones (POA&M) to address any shortcomings identified during the assessment. This subcontract opportunity was posted on May 10, 2026, with a response deadline of May 18, 2026. The work is to be performed primarily at Camp Pendleton, with the Department of Defense as the contracting agency through its Medical Supply Chain FSH office. The contract falls under NAICS code 541611, which generally pertains to administrative management and general management consulting services. The key deliverables are the compliance assessment, SPRS reporting, and an actionable POA&M to enhance cybersecurity posture in alignment with DoD requirements.