Cybersecurity & Supply Chain Risk Management (C-SCRM) for ICT

The contract titled Cybersecurity & Supply Chain Risk Management (C-SCRM) for ICT requires the implementation of robust cybersecurity controls across Department of Health and Human Services systems, with a focus on safeguarding information and communication technology infrastructure. It mandates the conduct of comprehensive ICT supply chain risk assessments to identify, evaluate, and mitigate potential threats originating from vendors and third-party providers. Compliance with Section 889 of the National Defense Authorization Act is a critical requirement, ensuring that covered telecommunications equipment and services from restricted foreign entities are excluded from HHS systems. Additionally, the contractor must support the development and enhancement of incident response planning, enabling timely detection, containment, and recovery from cybersecurity events affecting HHS operations. The work is to be performed in Rockville, Maryland, with a submission deadline of July 20, 2026, and the contract is structured as a subcontract under the NAICS code 541512 for computer systems design services, managed by the Omas Strategic Buying Center - Information Technology.