NIST SP 800-171 Compliance Assessment and System Security Planning

The contract requires the performance of a comprehensive NIST SP 800-171 compliance assessment to evaluate the current state of information security controls within a system owned by the Department of Defense’s ASC Commodities Division. This includes conducting a detailed gap analysis to identify shortcomings against the 110 required security controls, developing a complete System Security Plan (SSP) that documents policies, procedures, and control implementations, and providing a thorough system architecture description that outlines how data flows, components interact, and security measures are embedded. All deliverables must be finalized and submitted to the Supplier Performance Risk System (SPRS) to achieve a compliance score of 110, indicating full alignment with NIST standards. The work also entails creating a prioritized roadmap for implementing missing controls, addressing any deficiencies through actionable remediation steps, and ensuring long-term sustainment of compliance. The place of performance is located in New Cumberland, Pennsylvania, with a strict response deadline of May 21, 2026, and the contract is structured as a subcontract under NAICS code 541611, indicating it falls under management consulting services. All deliverables must be accurate, complete, and aligned with government expectations to meet federal cybersecurity requirements for handling controlled unclassified information.