NIST SP 800-171 Compliance Assessment & System Security Plan (SSP) Development

The contract requires a thorough self-assessment of the cybersecurity posture aligned with NIST SP 800-171 Rev 1 standards, focusing on the implementation and documentation of all required security controls. This includes evaluating current practices against the framework to identify gaps in compliance and documenting how each control is either fully implemented, partially implemented, or not implemented. The deliverables include a comprehensive System Security Plan that outlines the organization's approach to protecting controlled unclassified information, with clear descriptions of policies, procedures, and technical measures in place. The assessment must be methodical and evidence-based, ensuring that all findings are accurately recorded and supported by operational documentation. The final submission must be filed in the Department of Defense Supplier Performance Risk System, including a detailed roadmap that delineates a clear, actionable path to achieving full compliance with NIST SP 800-171 Rev 1. The roadmap should include timelines, resource allocations, responsible parties, and milestones for addressing identified deficiencies. Performance is tied to the location of Little Rock Air Force Base, and the work is structured as a subcontract under the NAICS code 541611, indicating it involves management consulting services related to cybersecurity. The solicitation is open with a submission deadline of May 19, 2026, and is managed by the Medical Supply Chain MD Surg FSF under the Department of Defense.