NIST SP 800-171 Compliance Assessment and System Security Plan (SSP) Development

The contract requires a comprehensive evaluation of information systems to ensure compliance with NIST SP 800-171 Rev 1 standards, focusing on the protection of controlled unclassified information. The assessment must thoroughly examine security controls, identify gaps, and produce detailed documentation of findings. Based on the results, a System Security Plan must be developed or updated to reflect current security postures and remediation strategies, aligning fully with NIST requirements. All deliverables must be submitted to the Department of Defense’s Supplier Performance Risk System for official recording and evaluation. The work is to be performed in Jacksonville, Florida, under a subcontract arrangement with the Medical Supply Chain MD Surg FSF, part of the Department of Defense. The solicitation was posted on May 11, 2026, and responses are due by May 18, 2026. The North American Industry Classification System code 541611 indicates the scope involves information technology consulting services. Performance must meet federal cybersecurity standards and be completed within the specified timeframe to support the DoD’s compliance obligations, with no set-aside provisions specified for small business or other categories.