NIST SP 800-171 Compliance Assessment and System Security Plan (SSP) Development

The contract requires performing cybersecurity assessments for Department of Defense contractors that handle Controlled Unclassified Information, with a focus on achieving compliance with NIST Special Publication 800-171 controls. Tasks include developing comprehensive System Security Plans tailored to each contractor's environment, conducting detailed gap analyses to identify deficiencies against NIST requirements, and performing risk assessments to evaluate potential threats and vulnerabilities. Remediation guidance will be provided to help contractors address identified weaknesses and strengthen their security posture to meet federal standards for protecting CUI. The work is structured as a subcontract under the Medical Supply Chain MD Surg FSF, managed by the Department of Defense, with performance required in Williamsburg, Virginia, ZIP 23185-5830. The solicitation was posted on May 10, 2026, and responses are due by May 18, 2026. The North American Industry Classification System code 541611 indicates the scope falls under management consulting services, emphasizing the advisory and compliance-driven nature of the engagement. All deliverables must align with federal cybersecurity frameworks and support the DoD’s broader objective of securing sensitive information across its supply chain.