Cybersecurity Supply Chain Risk Management (C-SCRM) Compliance Support

The contract requires full compliance with Cybersecurity Supply Chain Risk Management (C-SCRM) standards to ensure the integrity of software and systems by verifying that no prohibited equipment or components are integrated. This includes the completion of all necessary C-SCRM documentation and a formal attestation from the software producer affirming adherence to security and supply chain requirements. The work must align with NIST Special Publication 800-161, which outlines federal guidelines for managing supply chain risks, and must also satisfy all applicable export control regulations to prevent unauthorized technology transfer. The obligation is structured as a subcontract under NAICS code 541620, indicating it involves computer systems design and related services, and is issued by the U.S. Embassy in Lima under the Department of State. All deliverables must be finalized by the response deadline of June 1, 2026, at 4:00 PM, with no flexibility for late submissions. There is no set-aside designation specified, meaning the contract is open to all qualified entities regardless of size or ownership. The performance location is not explicitly defined, suggesting work may be conducted remotely or at the contractor’s facility as long as compliance deliverables are met.