NIST SP 800-171 Cybersecurity Compliance Assessment and Documentation

The contract requires the successful bidder to conduct a comprehensive NIST SP 800-171 compliance assessment to ensure the protection of Controlled Unclassified Information in accordance with Department of Defense requirements. This includes evaluating existing security controls across systems handling CUI, identifying gaps in compliance, and developing a detailed System Security Plan that documents the organization’s security posture and control implementation. In parallel, a Plan of Action and Milestones must be created to outline remediation steps, timelines, and responsible parties for addressing identified deficiencies. All deliverables must be finalized and submitted through the DoD Supplier Performance Risk System to satisfy DFARS clause requirements and demonstrate adherence to federal cybersecurity standards. The work is scoped as a subcontract under the Department of Defense’s ASC Commodities Division, with performance taking place in New Cumberland at ZIP code 17070-5002. The solicitation was posted on May 11, 2026, with responses due by May 14, 2026, indicating a tight turnaround for qualification and proposal submission. The NAICS code 541611 identifies this as an information technology services contract focused on cybersecurity consulting and compliance activities. Failure to complete the assessment, documentation, and SPRS submission accurately and on time may result in noncompliance with federal contracting obligations and jeopardize eligibility for future DoD work.