Post-Deployment Software Compliance Attestation

The contract requires formal attestation following major software updates to verify adherence to established security protocols, software bill of materials (SBOM) accuracy, and vulnerability exposure validation (VEX) obligations. This obligation applies to all significant releases or patches delivered under the agreement and must be documented and submitted in a standardized format to ensure regulatory and operational compliance. The provider must validate that each update meets defined security benchmarks, includes a complete and accurate SBOM listing all components and dependencies, and provides a timely, validated VEX document that identifies known vulnerabilities and their remediation status. This subcontract is issued by the U.S. Embassy in Phnom Penh under the Department of State, with performance tied to the location of Phnom Penh. The solicitation was posted on June 23, 2026, with a deadline for responses set for July 6, 2026, at 9:00 a.m. The North American Industry Classification System (NAICS) code 541611 indicates the work falls under management, scientific, and technical consulting services, specifically in the area of computer systems design. Although no set-aside designation or point of contact is specified, compliance with the attestation requirements is mandatory and will serve as a condition of continued contract performance.