NIST SP 800-171 Cybersecurity Compliance Assessment and Reporting

The contract requires the performance of a comprehensive NIST SP 800-171 cybersecurity assessment to evaluate compliance with federal security requirements for handling controlled unclassified information. This includes the development of a full System Security Plan that documents the organization’s security controls, the generation of a formal compliance score based on assessed control implementation, and the mandatory submission of all findings to the Supplier Performance Risk System. If any security gaps are identified during the assessment, the contractor must also create and maintain a Plan of Action and Milestones to remediate deficiencies and achieve full compliance. The work must be completed and results submitted within the specified timeframe, with the performance location designated as FPO, 96616, and the contracting entity is the Department of Defense through C AND T SUPPLY CHAIN under a subcontract arrangement. The solicitation is open for responses until May 26, 2026, and is classified under NAICS code 541612 for management consulting services.