NIST SP 800-171 Compliance Assessment Services

The contract requires a formal assessment of the prime contractor’s information systems to verify compliance with NIST Special Publication 800-171 standards for the protection of Controlled Unclassified Information, as mandated by DFARS clause 252.240-7997. The assessment must evaluate the adequacy of security controls implemented to safeguard CUI, ensuring alignment with federal requirements for information systems handling sensitive but unclassified data. This engagement is conducted under a subcontract and is part of an ongoing obligation to maintain secure information environments within the Department of Defense supply chain. The work is centered in Tracy, California, with a zip code of 95304-5000, and the solicitation was posted on July 23, 2026, with responses due by August 3, 2026. The contract falls under NAICS code 541611, which classifies it as administrative management and general management consulting services. The performing organization is expected to demonstrate expertise in cybersecurity assessments, particularly in the context of NIST 800-171 controls, and deliver a detailed evaluation report that identifies gaps, risks, and recommendations for remediation. The assessment must be thorough, impartial, and fully documented to satisfy Department of Defense auditing and compliance requirements.