NIST SP 800-171 Compliance Assessment & System Security Plan Development

The contract requires performing a thorough self-assessment against the NIST SP 800-171 Rev 1 standards to evaluate compliance with cybersecurity requirements for protecting controlled unclassified information. This involves identifying existing security controls, conducting a detailed gap analysis to pinpoint deficiencies, and either developing a new System Security Plan or updating an existing one to reflect current practices and remediation efforts. The final deliverable must include formal documentation suitable for submission to the Supplier Performance Risk System, ensuring alignment with Department of Defense expectations and regulatory obligations. The work is scoped as a subcontract under the Department of Defense’s ASC Commodities Division, with performance anticipated to occur in Tracy, California, at the zip code 95304-5000. The solicitation was posted on May 11, 2026, and responses are due by May 19, 2026. The North American Industry Classification System code 541611 indicates the primary focus is on administrative management and general management consulting services, emphasizing the need for expert-level cybersecurity advisory support. All deliverables must be precise, auditable, and structured to meet federal reporting standards without reliance on external documentation or references.