NIST SP 800-171 Cybersecurity Assessment Services

The contract requires the performance of cybersecurity assessments on System Security Plans (SSPs) for systems that process, store, or transmit Controlled Unclassified Information (CUI), with strict adherence to the requirements outlined in NIST SP 800-171 Revision 1. The assessments must evaluate the implementation and effectiveness of security controls, identifying gaps or deficiencies and providing actionable findings to ensure compliance. All results must be formally documented and submitted to the Supplier Performance Risk System (SPRS) as mandated by federal contracting standards. The work is structured as a subcontract under the Department of Defense, specifically managed by the ASC Supplier Oper OEM Division, with performance expected to occur in Tracy, California, at the ZIP code 95304-5000. The solicitation was posted on May 12, 2026, and responses are due by May 20, 2026, with the NAICS code 541611 indicating it falls under Management Consulting Services.