NIST SP 800-171 Compliance Self-Assessment Support

The contract requires support to the prime contractor in performing a NIST SP 800-171 self-assessment to ensure compliance with cybersecurity requirements for handling controlled unclassified information. This includes conducting a detailed gap analysis against the NIST controls, preparing all necessary documentation to demonstrate adherence, and readiness for an eventual Department of Defense assessment under DFARS 252.204-7020. The work is scoped to align with the DoD’s mandate for subcontractors to meet cybersecurity standards when processing, storing, or transmitting sensitive defense information. The task is positioned as a subcontract under the MEDICAL SUPPLY CHAIN FSH agency, with performance based in Williamsburg, Virginia, at the ZIP code 23185-5830. The North American Industry Classification System code 541611 indicates the effort falls under management consulting services, emphasizing advisory and procedural alignment rather than technical implementation. Responses must be submitted by May 18, 2026, following the solicitation’s posting on May 10, 2026, and the work directly supports the broader defense supply chain’s cybersecurity posture under federal regulatory frameworks.