NIST SP 800-171 Compliance Assessment & System Security Plan (SSP) Development

The contract requires a comprehensive assessment of NIST SP 800-171 Rev 1 compliance across all 110 security controls, identifying any gaps in current practices and procedures related to protecting controlled unclassified information. The work involves evaluating existing systems, policies, and technical safeguards to determine where deficiencies exist, with the goal of achieving full compliance. A detailed System Security Plan (SSP) must be developed to document the organization's approach to meeting all required controls, including implementation statuses, responsible parties, and mitigation strategies for any outstanding gaps. In addition to the SSP, a clear roadmap to full compliance must be delivered, outlining phased actions, timelines, resource requirements, and measurable milestones to ensure all 110 controls are fully addressed and sustained. The deliverables are intended for use by the Department of Defense’s Medical Supply Chain MD Surg FSF, with performance taking place at FPO, zip 96691. The solicitation is structured as a subcontract and is open for responses through May 19, 2026, under NAICS code 541611 for management consulting services.