NIST SP 800-171 Cybersecurity Compliance Assessment

The contract requires a comprehensive cybersecurity assessment to verify compliance with NIST Special Publication 800-171 standards, focusing on the protection of controlled unclassified information within the defense supply chain. The provider must develop a complete System Security Plan that documents security controls, procedures, and risk mitigation strategies aligned with NIST guidelines. A Basic Assessment must be conducted and submitted to the Department of Defense’s Supplier Performance Risk System, ensuring transparency and accountability in the contractor’s cybersecurity posture. The assessment must be thorough enough to support potential follow-on evaluations by DoD teams, including Medium or High level assessments, and the deliverables must demonstrate alignment with federal requirements for securing sensitive data. The work is designated as a subcontract under NAICS code 541612 and is performance-based at the FPO location with a zip code of 34089, with responses due by May 19, 2026, under the agency name Medical Supply Chain FSH within the Department of Defense.