Cybersecurity Supply Chain Risk Management (C-SCRM) Compliance & Software Attestation

The contract requires compliance with U.S. Government cybersecurity standards for software components, particularly focusing on SIM management platforms, mandating adherence to secure development practices and the submission of a Cybersecurity Supply Chain Risk Management (C-SCRM) attestation. All deliverables must align with federal requirements to ensure the integrity and protection of information systems throughout the software lifecycle, with an emphasis on verifying supplier credibility and minimizing supply chain vulnerabilities. The work is designated as a subcontract under the NAICS code 541512 and is administered by the U.S. Department of State through the U.S. Embassy in Kathmandu, with performance expected to occur in Kathmandu, Nepal, under the zip code 44600. The solicitation was posted on May 7, 2026, with a strict response deadline of May 11, 2026, at 11:14 AM local time, indicating a narrow window for submissions. While no set-aside type or organization restrictions are specified, the emphasis on C-SCRM attestation signals a high priority on vendor accountability and national security risk mitigation. The absence of a designated point of contact suggests interested parties must rely on the public SAM.gov listing for further details, and the international location of performance necessitates alignment with U.S. government cybersecurity frameworks despite geographical distance from domestic oversight entities.