NIST SP 800-171 Cybersecurity Compliance Assessment and System Security Plan Development

The contract requires a comprehensive assessment of systems handling Controlled Unclassified Information (CUI) in alignment with NIST SP 800-171 Rev 1, with the explicit purpose of identifying gaps in current security controls and developing or updating a System Security Plan to ensure full compliance. The evaluation must address all 110 security controls outlined in the NIST framework and align with the requirements of DFARS 252.204-7012, which mandates protection of CUI on contractor systems and reporting of cyber incidents. The deliverables include a detailed assessment report documenting findings, a revised or newly created SSP that reflects the organization's current security posture, and supporting documentation to demonstrate adherence to federal cybersecurity standards. The work is scoped for performance at New Cumberland, Pennsylvania, with a zip code of 17070-5002, and is issued under the NAICS code 541512 for computer systems design services. This is a subcontract opportunity under the Department of Defense, specifically through the Medical Supply Chain FSH, with a response deadline of May 4, 2026. The contractor must possess the technical expertise to interpret and implement NIST controls, understand the DoD’s CUI handling requirements, and produce a compliant SSP that withstands audit scrutiny. Success requires not only identifying weaknesses but also providing actionable remediation strategies and maintaining ongoing alignment with evolving federal cybersecurity policies.