NIST SP 800-171 Cybersecurity Assessment and Reporting

The contract requires the performance of NIST SP 800-171 Rev 1 cybersecurity compliance assessments for systems handling controlled unclassified information, including the development of comprehensive System Security Plans that document security controls, policies, and procedures aligned with federal requirements. The scope includes evaluating the current cybersecurity posture, identifying gaps, and implementing corrective actions to achieve full compliance, with all findings and evidence submitted through the Supplier Performance Risk System for official scoring and reporting. Assessment data must be securely transmitted, ensuring confidentiality and integrity throughout the submission process, and the contractor is responsible for maintaining accurate records and providing timely updates as required by Department of Defense standards. Work is to be performed at APO, 09094-3219, under a subcontract agreement with the Medical Supply Chain MD Surg FSF, a division of the Department of Defense, and must adhere to the NAICS code 541611 for management consulting services. The opportunity was posted on April 29, 2026, with responses due by May 5, 2026, and is open to qualified subcontractors capable of delivering federal cybersecurity assessment services under strict compliance timelines. All deliverables must meet NIST guidelines and support the agency’s mission to safeguard sensitive information within the supply chain ecosystem.