NIST SP 800-171 Compliance Assessment & System Security Plan Development

The contract requires performing a comprehensive gap assessment against the NIST SP 800-171 cybersecurity framework to evaluate the current state of an information system’s security controls. Based on the findings, the contractor must develop or update the System Security Plan to align with NIST requirements, ensuring all necessary policies, procedures, and control implementations are properly documented and integrated. The deliverables include a detailed compliance score that quantifies the system’s adherence to the standard and a prioritized remediation roadmap outlining actionable steps, timelines, and resources needed to address identified deficiencies and achieve full compliance. The work is classified as a subcontract under NAICS code 541612 and is being procured by the DOD’s ASC Commodities Division, with performance expected to occur at Hill AFB, Utah, in the ZIP code 84056-5734. The solicitation was posted on July 24, 2026, and responses are due by July 29, 2026. All activities must be completed in alignment with federal cybersecurity standards, with final deliverables intended to support the organization’s ability to protect controlled unclassified information and meet regulatory obligations. The contractor must demonstrate expertise in NIST 800-171 assessments, SSP development, and risk-based remediation planning.