Cyber-Supply Chain Risk Management (C-SCRM) Program Development

The contract seeks the development or assessment of a comprehensive Cyber-Supply Chain Risk Management program aligned with NIST Special Publication 800-161, requiring the implementation of robust policies, standardized risk assessment methodologies, and rigorous supplier vetting procedures to mitigate threats across the digital supply chain. The work must ensure end-to-end visibility and control over third-party vendors and components, integrating security controls that address known vulnerabilities, supply chain integrity, and continuous monitoring capabilities as outlined in the NIST framework. This subcontract is issued by the General Services Administration through its Special Contracting Branches under NAICS code 541690, with performance expected in Washington, D.C., and a response deadline of August 10, 2026. The effort is focused on strengthening federal supply chain resilience by establishing governance structures, documentation standards, and operational workflows that enable ongoing evaluation and mitigation of cyber risks introduced through external partners. Success will require proven expertise in federal cybersecurity standards, supply chain threat modeling, and the ability to deliver actionable, scalable solutions that meet federal compliance requirements without disruption to ongoing operations.