NIST SP 800-171 Compliance Implementation & System Security Plan (SSP) Development

The contract requires full implementation of NIST SP 800-171 security controls to ensure the protection of Controlled Unclassified Information within the system environment. This includes developing or updating a comprehensive System Security Plan that documents the organization’s approach to safeguarding data, with specific emphasis on access controls, incident response procedures, and audit logging mechanisms. A detailed gap analysis must be conducted to identify current security posture deficiencies against NIST requirements and to establish a corrective action plan that aligns with federal standards. All activities must be structured to prepare the system for an eventual Department of Defense assessment, requiring thorough documentation and evidence of compliance across all applicable control families. The work is to be performed at a designated location in Klamath Falls, Oregon, under a subcontract arrangement with the Department of Defense through its ASC SUPPLIER OPER OEM DIVISION. The solicitation was posted on May 3, 2026, and responses are due by May 11, 2026, indicating a tight timeline for proposal submission and execution. The North American Industry Classification System code 541512 identifies this as information technology services, specifically focusing on custom computer programming and security consulting. Compliance with these requirements will be critical for maintaining eligibility as a defense contractor handling sensitive information and supporting DoD operational readiness.