System Security Plan (SSP) Development and Architecture Documentation

The contract requires the development or updating of a System Security Plan (SSP) for an information system that processes Controlled Unclassified Information (CUI), ensuring full compliance with the security requirements outlined in NIST Special Publication 800-171. The SSP must provide a detailed description of the system’s architecture, operational boundaries, and the implementation of security controls necessary to safeguard CUI, covering areas such as access control, audit and accountability, configuration management, and incident response. The deliverable must reflect a thorough understanding of federal cybersecurity standards and demonstrate how the system mitigates risks associated with handling sensitive, non-classified data. This is a subcontract opportunity issued under the Department of Defense, specifically through the Medical Supply Chain MD Surg FSF, with the place of performance listed as APO, ZIP 96260-5479. The solicitation was posted on April 29, 2026, and responses are due by May 5, 2026, indicating a short turnaround time for submission. The North American Industry Classification System (NAICS) code 541512 identifies the work as custom computer programming services, suggesting that the contractor must possess technical expertise in cybersecurity documentation and system architecture design. The contract is not set aside for any specific small business category, and interested parties must access the full solicitation through the DIBBS platform to ensure complete understanding of submission requirements and evaluation criteria.