System Security Plan (SSP) Development and Maintenance

The contract requires the development, updating, and ongoing maintenance of System Security Plans (SSPs) that fully align with the control families outlined in NIST SP 800-171, specifically for IT systems that handle Controlled Unclassified Information (CUI). This includes creating detailed system diagrams, writing comprehensive narratives that describe how each security control is implemented, and maintaining accurate Plan of Action and Milestones (POA&M) tracks to document remediation efforts for identified security weaknesses. The work must ensure continuous compliance with federal standards and provide clear, auditable evidence of security posture across the supported systems. The contract is a subcontract under the Department of Defense, issued by the Medical Supply Chain MD Surg FSF, with performance required at Cannon AFB, New Mexico, ZIP 88101-5009. It falls under NAICS code 541512 for Computer Systems Design Services and is scheduled for a response deadline of May 18, 2026, with the solicitation posted on May 11, 2026. The scope emphasizes not just initial documentation but sustained oversight and revision of security plans to reflect evolving threats, system changes, and regulatory requirements, ensuring uninterrupted protection of CUI throughout the lifecycle of the supported IT systems.