NIST SP 800-171 Cybersecurity Compliance Assessment Services

This contract involves providing cybersecurity compliance assessment services focused on NIST SP 800-171 standards for systems managing Controlled Unclassified Information (CUI). The scope includes conducting thorough evaluations, scoring system compliance, reporting to the Supplier Performance Risk System (SPRS), and developing Plans of Action and Milestones (POA&M) to ensure that systems achieve a minimum compliance score of 110. The services are aimed at supporting the Department of Defense's Medical Supply Chain MD SURG FSF office, with work to be performed at a designated facility located in a Fleet Post Office (FPO) area. The contract is classified as a subcontract under the NAICS code 541611, which corresponds to administrative management and general management consulting services. It was posted on May 10, 2026, with responses due by May 18, 2026. Although specific set-aside classifications and organizational types are not provided, the contract addresses a critical mandate for cybersecurity in defense supply chain operations, reflecting the government’s emphasis on securing sensitive yet unclassified information through stringent regulatory compliance and risk management practices.