NIST SP 800-171 Cybersecurity Compliance Assessment

The contract requires a comprehensive NIST SP 800-171 cybersecurity compliance assessment for Department of Defense contractor systems that process, store, or transmit Controlled Unclassified Information. The assessment must include a detailed documentation of all required security controls, a formal scoring of compliance against the NIST framework, and the submission of results to the Supplier Performance Risk System. The work is focused on ensuring adherence to federal cybersecurity standards for CUI protection within the DoD supply chain, with the place of performance located at Fort Stewart, Georgia, under the medical supply chain program. All deliverables must align with the NIST guidelines and be submitted in a format acceptable to the DoD for audit and compliance purposes. The solicitation is structured as a subcontract with a response deadline of May 18, 2026, and was posted on May 10, 2026, under the NAICS code 541611 for management, scientific, and technical consulting services. The contracting activity falls under the Department of Defense, specifically the Medical Supply Chain MD Surg FSF office, and no set-aside classification is specified. The assessment must be conducted in accordance with current NIST standards, and the successful contractor will be expected to provide evidence of control implementation, identify gaps, and recommend remediation steps to achieve full compliance. All findings must be accurately reflected in the SPRS submission to satisfy DoD contracting requirements.