NIST SP 800-171 Cybersecurity Compliance and Assessment

The contract requires the performance of a comprehensive cybersecurity assessment in accordance with NIST SP 800-171 Rev 1 to ensure compliance with Department of Defense requirements for protecting Controlled Unclassified Information. This includes evaluating current security controls within the system environment, identifying gaps against the prescribed standards, and developing a detailed System Security Plan that documents policies, procedures, and control implementations. The successful contractor must also prepare and submit a Basic Assessment through the Supplier Performance Risk System to officially certify compliance, ensuring the organization meets the mandatory security criteria for handling CUI within the DoD supply chain. The effort is scoped as a subcontract under the Medical Supply Chain Pharm FSA, with the place of performance designated as FPO, ZIP 96663-1290, indicating operations may involve deployed or expeditionary support environments. The North American Industry Classification System code 541611 identifies the work as information technology consulting services, underscoring the need for expertise in federal cybersecurity frameworks. The solicitation was posted on April 30, 2026, with responses due by May 6, 2026, requiring timely and accurate documentation to meet the DoD's stringent compliance deadlines. All activities must align strictly with NIST standards without deviation, and deliverables must be submitted correctly through the designated government portals to avoid non-compliance penalties or contract rejection.