GSA requires a C-SCRM Subject Matter Expert

The U.S. General Services Administration (GSA) is seeking a Cybersecurity and Supply Chain Risk Management (C-SCRM) Subject Matter Expert under a labor hour task order issued through its Multiple Award Schedule (MAS) Information Technology Solutions program. This requirement, solicited under number 47QTCX26Q0004 and set aside 100% for Service-Disabled Veteran-Owned Small Businesses (SDVOSB), aims to transform GSA’s acquisition programs from compliance-driven practices to a risk-informed, enterprise-wide governance structure capable of confronting sophisticated cyber-enabled supply chain threats. The contractor will provide comprehensive support across cybersecurity, enterprise risk management, business continuity planning, incident response, and project management, primarily in a virtual environment with no anticipated travel. The task order has a one-year base period from July 20, 2026, to July 19, 2027, with a maximum of 1,340 labor hours allocated for the Cybersecurity SME role, to be billed at rates no higher than those listed on the contractor’s GSA MAS contract under SINs 54151HACS or 54151S. All work must align with GSA policies, FAR and GSAM clauses, and standards for handling Controlled Unclassified Information (CUI), with full adherence to the Privacy Act and restrictions on removing government property or data without written authorization. Proposals must be submitted electronically no later than June 22, 2026, at 1:00 PM ET in two volumes: a technical quote limited to 15 pages (with specific sections capped at 5 and 3 pages respectively, while resumes have no page limit) and a price quote structured as a firm-fixed price based on the offeror’s MAS pricelist. The technical evaluation prioritizes the approach to risk management, staffing qualifications, and past performance, with non-price factors weighing significantly more than price in the best value tradeoff determination. Offerors must submit resumes, an organizational conflict of interest statement, a non-disclosure agreement, and a staffing plan template as attachments, and all deliverables—including reports, methodologies, and tools—must be provided in Microsoft 365 or Office 2021-compatible formats, marked as contractor-generated, and free of proprietary restrictions inconsistent with government rights. Deliverables require a draft and final iteration, subject to government review within 10 business days, with contractors given five days