NIST SP 800-171 Cybersecurity Assessment and SPRS Reporting

The contractor is required to perform a thorough cybersecurity assessment of their information system in full alignment with NIST SP 800-171 Revision 1, evaluating each of the 110 security controls mandated for protecting controlled unclassified information. The assessment must be methodical, documenting all findings with precision, identifying gaps, and proposing actionable remediation plans for any non-compliant controls. The completed evaluation must be formally reported and submitted to the Supplier Performance Risk System, including the assessed level of compliance, a numerical score reflecting overall security posture, and a documented strategy for addressing identified deficiencies. The work is to be conducted under a subcontract arrangement with the Department of Defense, specifically under the Aviation Supply Chain ESOC Buys office, with performance location designated at Pearl Harbor, 96860-5033. The solicitation was posted on May 10, 2026, and responses are due by May 18, 2026, with the NAICS code 541611 indicating the scope of services falls under administrative management and general management consulting services.