NIST SP 800-171 Cybersecurity Compliance Assessment & SPRS Reporting

The contract requires a comprehensive cybersecurity assessment of the contractor’s System Security Plan in alignment with NIST SP 800-171 Rev 1 standards, focusing on identifying gaps in control implementation and developing a remediation plan to address deficiencies. The assessment must be thorough, ensuring all required safeguards are evaluated against the framework’s 110 security controls, and findings must be formally documented and submitted to the Supplier Performance Risk System. The contractor is obligated to respond to any government inquiries arising from the assessment within 14 business days, emphasizing the need for timely and accurate communication. The work is classified as a subcontract under NAICS code 541611, issued by the Department of Defense through the Medical Supply Chain MD Surg FSF office, with performance required at Asheville, North Carolina, 28806. The solicitation was posted on May 11, 2026, with responses due by May 18, 2026, indicating a tight turnaround period for submission of deliverables. Compliance with NIST requirements is mandatory for continued eligibility to support DOD systems, and failure to meet deadlines or resolve identified gaps could impact the contractor’s standing in federal procurement systems.