NIST SP 800-171 Cybersecurity Assessment and Reporting

The contractor is required to perform a formal cybersecurity assessment of a contractor information system to determine compliance with the National Institute of Standards and Technology Special Publication 800-171 standards. This includes evaluating the system’s security controls, documenting gaps in compliance, and developing a detailed summary score that reflects the current state of adherence. A compliance timeline must be established outlining the steps, responsibilities, and deadlines necessary to achieve full conformance, alongside a comprehensive system security architecture that aligns with NIST SP 800-171 requirements. All findings, scores, timelines, and architectural details are to be compiled into a final report and submitted through the Supplier Performance Risk System, ensuring transparency and alignment with Department of Defense procurement protocols. The work is governed under a subcontract arrangement with a response deadline of May 18, 2026, and performance is expected to be conducted at the site in New Cumberland, Pennsylvania, under the oversight of the ASC Commodities Division.