NIST SP 800-171 Cybersecurity Compliance and Assessment

The contract requires the implementation of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information within the scope of the Medical Supply Chain MD Surg FSF project under the Department of Defense. The successful contractor must fully deploy all required security controls as outlined in the NIST publication, ensuring compliance with federal standards for protecting sensitive data handled in support of defense medical supply operations. This includes configuring systems, establishing policies and procedures, training personnel, and continuously monitoring for vulnerabilities to maintain a secure environment against cyber threats. In addition to implementation, the contractor is responsible for conducting formal assessments to verify the effectiveness of the applied controls, documenting findings, and submitting comprehensive assessment results to the Supplier Performance Risk System. The work must be performed at the designated place of performance in Williamsburg, Virginia, with all activities completed and reported prior to the response deadline of May 5, 2026. This subcontract is governed under NAICS code 541512 for computer systems design services and is part of a broader effort to enforce robust cybersecurity posture across the defense supply chain.