NIST SP 800-171 Compliance Assessment & System Security Plan (SSP) Development

The contract requires the development and ongoing maintenance of a System Security Plan (SSP) that fully complies with the requirements of NIST SP 800-171 Rev 1, focusing on the implementation of cybersecurity controls to protect controlled unclassified information. The contractor must conduct a comprehensive self-assessment of these controls, document the current implementation status with precision, and ensure all findings are accurately recorded to support submission to the Supplier Performance Risk System (SPRS). This work is critical for demonstrating compliance with federal cybersecurity standards and maintaining the integrity of information systems handling sensitive data. The effort is classified as a subcontract under the NAICS code 541611, with performance located at Perry Point, Maryland, 21902, under the oversight of the Department of Defense through the Medical Supply Chain FSH. The solicitation was posted on April 30, 2026, with a firm deadline for responses on May 7, 2026. The contractor must operate within the specified timeline and deliverables to meet the Defense Department’s requirements for cybersecurity posture documentation and readiness for SPRS reporting, ensuring alignment with government-wide compliance expectations and operational security protocols.