NIST SP 800-171 Cybersecurity Compliance & System Security Planning

The contract requires full implementation of NIST SP 800-171 cybersecurity safeguards to protect Controlled Unclassified Information (CUI) within the designated system environment. This includes developing a comprehensive System Security Plan that documents security controls, their implementation, and ongoing management procedures. A formal assessment of these controls must be conducted to verify compliance, with findings reported to the Supplier Performance Risk System (SPRS) to meet federal documentation and transparency requirements. The contractor is responsible for ensuring all subcontractors handling CUI also adhere to the same NIST SP 800-171 standards, meaning oversight, validation, and documentation of subcontractor compliance are mandatory components of the work scope. The effort is tied to a subcontract under the Department of Defense’s Medical Supply Chain MD Surg FSF, with performance centered in Schenectady, New York, ZIP 12301-1072. The North American Industry Classification System code 541512 indicates this work falls under Computer Systems Design Services, aligning with the technical nature of cybersecurity implementation and documentation. The solicitation was posted on May 10, 2026, with responses due by May 18, 2026, indicating a tight turnaround timeframe for submission. Although no set-aside type is specified, the requirement is focused on securing sensitive government information and demands proven expertise in NIST 800-171 compliance, SSP development, and SPRS reporting.