NIST SP 800-171 Cybersecurity Assessment and Compliance

The contract requires the performance of a cybersecurity self-assessment or formal evaluation to verify compliance with NIST SP 800-171 standards for protecting Controlled Unclassified Information (CUI) on non-federal systems. This assessment must comprehensively examine security controls outlined in the NIST guidelines to ensure appropriate safeguards are in place for handling, storing, and transmitting CUI. The results of the assessment must be submitted to the Supplier Performance Risk System (SPRS) as evidence of compliance, and failure to meet the requirements may impact eligibility for future DoD contracts. The work is designated as a subcontract under NAICS code 541611, with the ordering activity being the Department of Defense under the Maritime Supply Chain ESOC Buys division. The solicitation was posted on May 8, 2026, with a firm response deadline of May 13, 2026, indicating a narrow window for submission. Performance is expected to support government operations primarily through a military postal address in FPO with ZIP code 96306-0001, though no specific physical location is provided beyond that. The process is strictly procedural and focused on documentation and verification rather than technical implementation, meaning the contractor must have established policies, procedures, and technical controls aligned with NIST 800-171 and be prepared to validate them through a structured assessment. There is no set-aside information provided, and the contract is open to all eligible subcontractors capable of meeting the cybersecurity compliance criteria.