NIST SP 800-171 Cybersecurity Assessment and SPRS Reporting

The contract requires the execution of a medium or high-level cybersecurity assessment for systems that handle Controlled Unclassified Information, with a primary focus on validating compliance with the National Institute of Standards and Technology Special Publication 800-171 standards. The assessment must evaluate the security controls in place to protect CUI and ensure alignment with the required federal cybersecurity framework. All findings, including gaps, vulnerabilities, and remediation recommendations, must be formally documented and submitted to the Supplier Performance Risk System for official record and reporting purposes. Performance of this work is designated to take place in Tracy, California, with a submission deadline of May 20, 2026, and the solicitation was posted on May 12, 2026. The contract is structured as a subcontract under the Department of Defense’s ASC Supplier Oper OEM Division, falling under the NAICS code 541611 for Management, Scientific, and Technical Consulting Services. Compliance with NIST SP 800-171 is mandatory, and failure to meet the required security controls could result in non-conformance noted in SPRS, potentially affecting future contract eligibility and supplier rating. The work demands technical expertise in federal cybersecurity requirements and the ability to deliver accurate, actionable, and compliant reporting to an official government system.