Cybersecurity Supply Chain Risk Management (C-SCRM) Compliance

This contract requires full compliance with Cybersecurity Supply Chain Risk Management standards through the completion of a detailed C-SCRM questionnaire and a secure software development attestation. Participants must confirm that no prohibited equipment from named foreign entities—specifically Huawei, ZTE, or Kaspersky—is utilized in any part of their operations or deliverables. Additionally, all parties must disclose any affiliations with covered foreign entities to ensure transparency and mitigate potential supply chain vulnerabilities. The requirement applies to subcontractors working under the US Embassy Koror, part of the Department of State, and is tied to a NAICS code of 541611 for computer systems design services. Compliance is mandatory for award consideration, with responses due by July 17, 2026, and performance expected to be conducted in Koror, Palau, with a zip code of 96940. Failure to fully attest to these security conditions or to accurately report foreign ties will result in disqualification.