Cybersecurity Supply Chain Risk Assessment (CSCRA) Compliance & Reporting

The contract requires the performance and thorough documentation of Cybersecurity Supply Chain Risk Assessments for software components, with specific attention to identifying and reporting foreign affiliations, historical breach incidents, and complete Bill of Materials listings. Entities must systematically evaluate the integrity and origin of all software elements to ensure compliance with federal cybersecurity standards, focusing on potential supply chain vulnerabilities tied to international entities or compromised components. The assessment must be documented in detail to enable verification and audit readiness by the Social Security Administration’s Office of Acquisition and Grants. Subcontractors must submit all required documentation by the response deadline of August 4, 2026, under the NAICS code 541620, which covers computer systems design and related services. The solicitation is issued under a subcontract type with no set-aside designation, meaning all qualified entities may respond. While no specific point of contact or physical performance location is provided, all work must align with the SSA’s expectations for supply chain transparency and cybersecurity risk mitigation. The official solicitation can be accessed via the provided FedConnect link for additional context and submission instructions.