NIST SP 800-171 Compliance Assessment & System Security Plan Development

A comprehensive NIST SP 800-171 compliance assessment must be conducted to evaluate the current security posture of systems handling controlled unclassified information, with a focus on identifying all gaps in the implementation of required security controls. The contract requires a detailed analysis of existing policies, procedures, and technical safeguards to determine alignment with the 110 security controls outlined in NIST SP 800-171 Revision 2, and to provide actionable recommendations for remediation. The selected contractor will then be responsible for either developing a new System Security Plan or updating an existing one to accurately reflect the organization’s security environment, control implementation, and risk management posture. In addition to the SSP, the contractor must prepare all supporting documentation necessary for submission to the Supplier Performance Risk System, ensuring that all required artifacts meet the Department of Defense’s standards for transparency and verifiability. The work must be performed in coordination with the Medical Supply Chain MD Surg FSF under the Department of Defense, with performance localized to Perry Point, Maryland, 21902. The solicitation, issued as a subcontract under NAICS code 541618, has a response deadline of May 5, 2026, and the successful party is expected to deliver a fully compliant, audit-ready package that enables the prime contractor to maintain eligibility for DoD contracts involving controlled unclassified information.