NIST SP 800-171 Compliance Assessment & System Security Plan (SSP) Development

The contract requires the performance of a comprehensive NIST SP 800-171 Rev 1 assessment to evaluate the implementation of security controls within a system handling controlled unclassified information. This includes developing a detailed System Security Plan that clearly outlines the system boundary, describes all applicable security controls, and documents the current compliance posture against NIST requirements. The deliverables must be thorough, accurate, and capable of demonstrating full alignment with federal cybersecurity standards for nonfederal systems. The assessment findings must be formally submitted to the Supplier Performance Risk System (SPRS) to update the organization’s cybersecurity posture in the Department of Defense’s evaluation framework. Additionally, the contractor must be prepared to support rebuttals or provide clarifications if any discrepancies or deficiencies are flagged during the SPRS review process. The work is scoped under a subcontract with a performance location in New Cumberland, Pennsylvania, under the Department of Defense’s ASC SUPPLIER OPER AE AND AF DIV, and must be completed by the response deadline of May 21, 2026.