System Security Plan (SSP) Development and Assessment

The contract requires the development and validation of a System Security Plan (SSP) that fully complies with the National Institute of Standards and Technology Special Publication 800-171 Revision 1 standards. This includes conducting a thorough gap analysis to identify deficiencies in current security controls, evaluating the effectiveness of existing measures, and assigning a compliance score based on the implementation status of each required safeguard. The work must result in a documented, actionable SSP that demonstrates adherence to federal cybersecurity requirements for protecting controlled unclassified information within nonfederal systems. The solicitation is issued as a subcontract under the Department of Defense, specifically by the ASC SUPPLIER OPER OEM DIVISION, with performance expected to take place at the FPO ZIP code 96678. The response deadline is May 18, 2026, and the North American Industry Classification System code 541611 identifies the scope as management, scientific, and technical consulting services. The work is not set aside for any specific small business category, and bidders must ensure their approach addresses all NIST 800-171 Rev 1 controls comprehensively, with clear evidence of assessment and validation methodologies.