NIST SP 800-171 Cybersecurity Assessment and SPRS Reporting

The contract mandates a thorough cybersecurity assessment of the contractor's information system in accordance with NIST SP 800-171 Revision 1 standards. This involves evaluating all 110 specified security controls to identify vulnerabilities and compliance gaps. The contractor is required to comprehensively document the assessment findings and develop a formal report outlining the results, including an overall assessment level, security score, and detailed remediation plans to address any deficiencies. The completed assessment and supporting information must then be submitted to the Supplier Performance Risk System (SPRS) to ensure visibility and transparency of cybersecurity posture. The work is designated as a subcontract with a focus on cybersecurity services, specifically under NAICS code 541611. The performance location for this contract is Pearl Harbor, with the Department of Defense’s Aviation Supply Chain ESOC BUYS office overseeing the effort. Key administrative timelines include the posting date of May 10, 2026, and a response deadline of May 18, 2026.