NIST SP 800-171 Compliance Assessment and System Security Plan (SSP) Development

The contract requires a detailed gap analysis and compliance assessment against NIST SP 800-171 requirements for systems that handle Controlled Unclassified Information (CUI). The primary objective is to identify deficiencies in current security controls and document the findings to guide remediation efforts. This includes evaluating the existing security posture across all applicable control families outlined in the NIST standard, ensuring alignment with federal cybersecurity mandates for non-federal systems handling CUI. Following the assessment, a comprehensive System Security Plan (SSP) must be developed to formally document the architecture of the CUI-handling system, the implemented and planned security controls, and the risk management strategy. The SSP must clearly describe how each NIST 800-171 requirement is addressed, including any compensating controls or deviations, and provide a roadmap for achieving full compliance. The work is positioned as a subcontract under the Department of Defense’s Strategic Acquisition Program Directorate, with a response deadline of May 13, 2026, and is classified under NAICS code 541611 for management, scientific, and technical consulting services.