NIST SP 800-171 Compliance Assessment and System Security Plan (SSP) Development

The contract requires performing cybersecurity compliance assessments in accordance with NIST SP 800-171 Revision 1 to evaluate the security posture of Department of Defense information systems. The work involves identifying gaps in security controls, analyzing existing safeguards, and determining noncompliance areas that pose risks to controlled unclassified information. The contractor must develop or update a comprehensive System Security Plan that accurately documents the current compliance status, outlines all identified vulnerabilities, and details actionable remediation steps to achieve full adherence to NIST standards. This plan serves as a living document to guide ongoing security improvements and ensure alignment with federal cybersecurity requirements. The performance of this contract is located in Williamsburg, Virginia, with a zip code of 23185-5830, and falls under the NAICS code 541611 for management consulting services. It is structured as a subcontract under the Medical Supply Chain MD Surg FSF, a unit within the Department of Defense. The solicitation was posted on May 11, 2026, and responses are due by May 18, 2026. While no set-aside type is specified, the contract is tied to a DIBBS platform listing, indicating it is part of a broader defense procurement framework that requires precise adherence to technical documentation and compliance timelines. All deliverables must be precise, auditable, and aligned with DoD expectations for protecting sensitive information systems.