NIST SP 800-171 Compliance Assessment and System Security Plan (SSP) Development

The contract requires a comprehensive assessment of contractor information systems to ensure adherence to NIST Special Publication 800-171 standards for protecting Controlled Unclassified Information within Department of Defense environments. This includes evaluating existing security controls, identifying gaps in compliance, and documenting the current state of implementation across all relevant systems. The primary deliverable is a detailed System Security Plan that clearly defines system boundaries, outlines all applicable security controls, and provides an accurate status report on how each control has been implemented or is planned for implementation. The work is being conducted as a subcontract under the Department of Defense’s Medical Supply Chain MD Surg FSF, with performance location specified at Camp Pendleton, California, 92055-5627. The solicitation, issued under NAICS code 541611 for Management Consulting Services, must be responded to by May 18, 2026, and is intended to support the broader DoD cybersecurity compliance framework by ensuring that contractor systems meet mandatory federal requirements for safeguarding sensitive information. The assessment and SSP development must reflect a thorough understanding of NIST SP 800-171 requirements and demonstrate actionable, audit-ready documentation to support ongoing defense contract obligations.