Cyber Supply Chain Risk Management (C-SCRM) & SBOM Development

The contract requires the development and ongoing maintenance of a Cyber Supply Chain Risk Management (C-SCRM) plan aligned with NIST SP 800-161 standards for all software components within Department of Justice systems. This includes the generation of validated Software Bills of Materials (SBOMs) to ensure transparency, traceability, and security of software supply chains across DOJ infrastructure. The work must be performed in accordance with federal cybersecurity frameworks and deliverables must be rigorously validated to meet government integrity requirements. The contract is structured as a subcontract under a Total Small Business Set-Aside designation, limiting eligibility to small businesses as defined by SBA guidelines, and is classified under NAICS code 541611 for computer systems design services. Performance is to be conducted at Pennington Gap, Virginia, with a response deadline of May 7, 2026, and the award is expected to be issued by the U.S. Penitentiary Lee under the Department of Justice.