NIST SP 800-171 Cybersecurity Assessment

The contract mandates a comprehensive cybersecurity assessment aligned with NIST SP 800-171 Rev 1 to ensure the protection of Controlled Unclassified Information (CUI) within the scope of operations. The work includes thorough documentation of all applicable security controls, development of a detailed System Security Plan (SSP) that outlines how controls are implemented and maintained, and active facilitation of a government-led medium or high-level assess ment to validate compliance. The assessment must meet federal standards for safeguarding sensitive data and requires close coordination with government evaluators to achieve formal validation. All activities must be conducted in accordance with NIST guidelines and integrated into the existing security framework at the designated location in San Diego, California, with the zip code 92135-7096. The subcontract is classified under NAICS code 541690 and is part of a larger Department of Defense initiative managed by the Medical Supply Chain Pharm FSA, with responses due by May 18, 2026.