NIST SP 800-171 Cybersecurity Compliance Assessment and System Security Plan (SSP) Development

The contract requires performing a comprehensive gap assessment to evaluate current cybersecurity practices against the requirements of NIST SP 800-171 for systems that process, store, or transmit Controlled Unclassified Information. Based on the findings, the contractor must implement the necessary security controls to bring the systems into full compliance with the standard. A detailed System Security Plan must be developed and continuously maintained to document the security posture, control implementation, and ongoing management processes. Compliance status must be regularly assessed and reported through the Department of Defense Supplier Performance Risk System to ensure transparency and adherence to federal cybersecurity mandates. The work is scoped as a subcontract under the Department of Defense, specifically for the ASC SUPPLIER OPER OEM DIVISION, with performance required at a location in Tracy, California, ZIP 95304-5000. The solicitation, issued under NAICS code 541611 for Computer Systems Design Services, closed for responses on May 4, 2026, and the effort is not subject to any specific set-aside classification. The successful bidder will be responsible for ensuring all deliverables meet DoD cybersecurity expectations and remain current throughout the contract lifecycle.