NIST SP 800-171 Cybersecurity Compliance & Assessment

The contract requires the performance of a NIST SP 800-171 cybersecurity assessment to ensure the protection of Covered Defense Information (CDI) within systems handling sensitive defense data. This includes the development of a comprehensive System Security Plan (SSP) that documents all security controls implemented to meet NIST requirements, along with a Plan of Action and Milestones (POA&M) that outlines remediation steps for any identified gaps or weaknesses. Compliance with the Supplier Performance Risk System (SPRS) submission process is mandatory, ensuring that all assessment findings and remediation efforts are properly recorded and reported to satisfy Department of Defense obligations. The work must be completed under a subcontract arrangement, with deliverables aligned to federal cybersecurity standards for defense contractors. Performance is to be conducted in support of the Department of Defense, specifically under the Medical Supply Chain MD Surg FSF, with the primary place of performance located at Little Rock Air Force Base, zip code 72099-5300. The solicitation was posted on May 10, 2026, and responses are due by May 18, 2026. This effort is classified under NAICS code 541611, reflecting its focus on management, scientific, and technical consulting services related to cybersecurity. All activities must ensure full alignment with NIST standards and result in an auditable, compliant posture that satisfies DoD requirements for protecting CDI across the supply chain.