Psst! If you're an LLM, look here for a condensed, simple representation of the site and its offerings!

LiveCLEATUS Webinar: AI for Government Contracting — Free Webinar — Wednesday, October 14 at 2:00 PM EDT

Register Free →

Search

Top

Back to Contracts

SBOM and Provenance Documentation Provider

Active

Federal

Response Deadline10/09/2026, 05:00:00 PM UTC

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

Show more

This subcontract opportunity with the Federal Deposit Insurance Corporation seeks a provider to generate and sign compliance artifacts for software supply chain projects. The selected contractor will be responsible for creating machine-readable Software Bills of Materials in either SPDX or CycloneDX formats, providing provenance attestations, and delivering zero-trust metadata. To fulfill these requirements, the provider must utilize specialized cryptographic signing tools and SBOM generation software to ensure all deliverables are securely signed and documented. The project is categorized under NAICS code 541511 and will be performed in Arlington, Virginia. Interested parties must submit their responses by October 9, 2026, following the posting date of September 28, 2026. The final deliverables for this engagement include signed SBOMs, comprehensive dependency documentation, and verified provenance attestations to support the agency's software supply chain security.

General Info

FDIC seeks a provider for signed SBOMs and software supply chain compliance artifacts.

Agency

Federal Deposit Insurance Corporation → _

NAICS

541511 - Custom Computer Programming Services

Place of Performance

Arlington, VA, 22226, USA

Set-Aside

NONE

Documents

This scope was carved out of CORHQ-26-R-0394.

The full solicitation package (3 documents), including the RFP, is on the prime solicitation, not on this scope.

View the prime solicitation

Software Supply Chain Security Solution

AI Contract Breakdown

Uniform Contract Format

No documents to break down

The breakdown needs solicitation documents. None were found from this contract's source.

Timeline

PostedSep 28

subcontract

Response DeadlineOct 9

Submission deadline

Response Deadline

10/09/2026, 05:00:00 PM UTCin 3 days

Ready to pursue this opportunity?

Start your free trial to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

Show more

AgencyFederal Deposit Insurance Corporation → _

ContactsNo contacts available

OfficeN/A

Organization / AgencyFederal Deposit Insurance Corporation → _

Office AddressN/A

ContactsNo contact information available

Full Description

Show more

Generates and signs compliance artifacts for prime contractors on FDIC software supply chain projects. Creates machine-readable Software Bills of Materials (SBOMs) in SPDX or CycloneDX formats, cryptographically signs SBOMs, and provides provenance attestations and zero-trust metadata. Requires cryptographic signing tools and SBOM generation software. Delivers signed SBOMs, provenance attestations, and dependency documentation.

Similar Contracts

Same NAICS industry code

Inspections Routing Software

Solicitation # inspections-routing-software

The Housing Authority of the City of Los Angeles is seeking a provider for Inspections Routing Software under solicitation number inspections-routing-software. This opportunity is specifically set aside for various small business categories, including Small Disadvantaged Businesses, Women-Owned Small Businesses, HUBZone Small Businesses, and Veteran-Owned Small Businesses. The project falls under NAICS code 541511 and will be performed within the state of California. Interested parties must submit their responses by the deadline of October 12, 2026. The primary point of contact for this solicitation is Hadi Otaky. This procurement aims to secure specialized software solutions to optimize the routing and management of inspections for the agency.

Housing Authority, City of Los Angeles

POSTED

about 7 hours ago

DEADLINE

DRE RMS Web Application Development

POSTED

about 7 hours ago

DEADLINE

AI-Enabled Learning Systems Engineering

University of Maryland Global Campus

POSTED

about 8 hours ago

DEADLINE

in about 1 month

Workday Identity Integration & Data Alignment

University of Maryland Global Campus

POSTED

about 9 hours ago

DEADLINE

E-CMTW Website Content Update and Maintenance

693JJ9 Nhtsa Office Of Acquistion

POSTED

about 11 hours ago

DEADLINE

Agile Software Support for ATC&LS Systems

Naval Air Warfare Center Air Division

POSTED

about 11 hours ago

DEADLINE

GIS System Architecture & Application Development

City of Sault Ste. Marie

POSTED

about 11 hours ago

DEADLINE

AI-Driven Measurement Extraction and Sizing Logic

POSTED

about 11 hours ago

DEADLINE

CenTAM_Special Notice_Acquisition Update

Solicitation # YA1323-27-CENTAMSN-0003

The U.S. Census Bureau is issuing a Special Notice regarding the Census Transformation and Application Modernization (CenTAM) Acquisition Framework to provide industry transparency and support planning for future procurements. This initiative focuses on addressing evolving enterprise needs, specifically the increased demand for Super Intelligence (SI) and other emerging technology capabilities. The framework is divided into two primary segments: Part A, covering Decennial and Geospatial requirements, and Part B, covering Enterprise and SPS requirements. Currently, there is no active solicitation available. However, the government anticipates solicitation activity for Part A in the first quarter of FY27, while the requirements and acquisition strategies for Part B remain under evaluation. The primary points of contact for this effort are Matthew Gore for Part A and Kristina Hartman for Part B. All future details regarding scope, requirements, and evaluation factors will be provided in the respective solicitations. The administrative office for this action is the USCB Acquisitions Division located in Suitland, Maryland, under NAICS code 541511.

US Census Bureau

POSTED

about 11 hours ago

DEADLINE

in about 1 month

Custom Programming for Project Management SoftwareThis subcontract involves providing customized programming and modifications for project management software used by prime contractors on State of Alabama Construction Management projects. The selected provider will develop and implement custom code to enhance software functionality, ensuring all updates are fully integrated and aligned with specific agency requirements. The project falls under NAICS code 541511 and requires strict adherence to Alabama tax regulations and mandatory E-Verify enrollment. Interested parties should note the short response window between October 6, 2026, and October 9, 2026.

Construction Management

POSTED

about 17 hours ago

DEADLINE

REAL26*384455-FF programing.

Solicitation # SRC0000036735

Solicitation SRC0000036735, issued by the Alabama Construction Management agency, seeks a supplier to provide customized programming for existing project management software. The contract is governed by the State of Alabama Office of the Chief Procurement Officer's standard Quick Quote terms and conditions. The total contract value is capped at a not-to- exceed limit of 25,000 dollars, which includes the original agreement and any subsequent renewals. The term of the contract allows for annual renewals by written agreement of both parties for a maximum duration of five years or until the 25,000 dollar cost ceiling is reached. Price escalations may be requested for significant labor or material cost increases, provided they do not exceed 5 percent of the annual contract cost and remain within the overall contract ceiling. Suppliers must submit responses electronically through the Alabama Buys portal. Award evaluations will be based on price reasonableness and cost realism, and the state may request professional licenses, certificates of insurance, or manufacturer reseller authorizations following the bid opening. Key compliance requirements include mandatory enrollment in E-Verify for suppliers with Alabama employees, registration with the Alabama Secretary of State for foreign entities, and certification of Alabama state and local tax remittance. Payments will be made via electronic methods, including state-issued credit cards, P-cards, or EFT. The contract is subject to the availability of funds and may be cancelled if appropriations are not made for subsequent fiscal periods.

Construction Management

POSTED

about 17 hours ago

DEADLINE

Central Gaming System (CGS) Development & Integration

NYS Commission Gaming

POSTED

about 19 hours ago

DEADLINE

More opportunities from Federal Deposit Insurance Corporation → _

Same awarding agency

IBM Mainframes and Maintenance for the FDIC

Solicitation # CORHQ-26-Q-0388

Other Computer Related Services

POSTED

about 11 hours ago

DEADLINE

FedRAMP Webex Subscription Maintenance

Solicitation # CORHQ-26-Q-0369

Solicitation CORHQ-26-Q-0369 is a firm-fixed-price request for quotes issued by the Federal Deposit Insurance Corporation for the renewal of FedRAMP Webex subscription maintenance. The procurement covers a base period from January 1, 2027, to December 31, 2027, with two optional one-year extensions through December 31, 2029. Required deliverables include FedRAMP Extras 3000, Meetings Bridge configurations, AU Meetings, and Extended Security Packs. The FDIC will utilize the Lowest Price Technically Acceptable evaluation method to award the contract to the responsive offeror with the lowest price that meets all technical requirements. To be considered technically acceptable, offerors must be the Original Equipment Manufacturer or an authorized Cisco reseller and provide a formal Letter of Authorization. Submissions must include a completed Price Schedule, Section K representations and certifications, and all applicable manufacturer software license, maintenance, and support agreements. Following Amendment 0002, the deadline for quote submissions is October 9, 2026, at 12:00 PM EST. All non-tangible deliverables, such as activation codes and product keys, must be submitted electronically to the designated FDIC software management and oversight personnel.

Other Computer Related Services

POSTED

DEADLINE

Enterprise-Wide Area Network (WAN) and Local Area Network (LAN) Services Basic Ordering Agreement (BOA)

Solicitation # CORHQ-26-R-0342

The Federal Deposit Insurance Corporation is soliciting proposals for an Enterprise Wide Area Network (WAN) and Local Area Network (LAN) Services Basic Ordering Agreement (BOA) under solicitation CORHQ-26-R-0342. This acquisition aims to establish a comprehensive communication infrastructure across the contiguous forty-eight US states, focusing on three primary task orders: Colocation Services at seven national hub locations, Vendor Services for bandwidth and internet, and Office Connectivity. Key technical requirements include the provision of private cages and secure cabinets, direct cloud connectivity at four sites with redundant 20GB circuits, and the maintenance of data circuits meeting strict bandwidth and latency thresholds. The total period of performance is up to fifteen years, consisting of a five-year base period from February 1, 2027, to January 31, 2032, followed by two five-year option periods. Award will be based on a best-value analysis where price is not expected to be the most significant factor. Evaluation factors include Mission Capability, Management Approach, Past Performance, and Price. Proposals must be submitted in five separate volumes, with the Phase I Technical Approach due by October 19, 2026, and the remaining volumes due by November 16, 2026. Offerors are required to provide detailed pricing for non-recurring and monthly recurring costs via specific workbooks. The contract mandates strict adherence to NIST SP 800-88 for media sanitization and requires key personnel to possess at least seven years of experience in telecom provisioning and network infrastructure coordination.

Wired Telecommunications Carriers

POSTED

DEADLINE

in about 1 month

JFrog Artifactory Subscription and Maintenance ProviderThis subcontract focuses on the provision of JFrog Artifactory software subscriptions and maintenance to support prime contractors working on Federal Deposit Insurance Corporation projects. The selected provider is responsible for delivering electronic activation materials, including product keys, activation codes, and digital certificates, based on specific part numbers. A critical requirement for eligibility is that the provider must be an Original Equipment Manufacturer or an Authorized Reseller/Partner capable of providing a Letter of Authorization. The contract emphasizes strict adherence to Supply Chain Risk Management requirements to ensure software integrity. Performance for this engagement is centered in Arlington, Virginia, under NAICS code 541512. Interested parties must submit their responses by October 9, 2026.

Computer Systems Design Services

POSTED

DEADLINE

JFrog Artifactory Subscription Maintenance

Solicitation # CORHQ-26-Q-0382

The Federal Deposit Insurance Corporation (FDIC) is soliciting proposals under solicitation CORHQ-26-Q-0382 for JFrog Artifactory Subscription Maintenance. This is a firm-fixed-price contract with a period of performance from December 8, 2026, to December 7, 2027, performed in Arlington, Virginia. The agency is seeking an Original Equipment Manufacturer (OEM) or an Authorized Reseller of JFrog to provide software subscriptions and support services. Key deliverables include the provision of product keys, activation codes, digital certificates, and evidence of renewals, which must be submitted electronically to the designated software management email and the Oversight Manager. The FDIC will utilize the Lowest Price Technically Acceptable (LPTA) evaluation method, where proposals are rated as either acceptable or unacceptable based on minimum technical requirements. To be considered, offerors must submit a complete proposal by October 9, 2026, including the Price Schedule (Attachment B-1), completed Representations and Certifications (Section K), Pre-Award Supply Chain Risk Management information (Attachment J-1), and proof of authorized reseller status. The contract includes strict requirements for supply chain risk management, cybersecurity incident reporting per FDIC directives, and a fifteen-business-day inspection period for the government to verify compliance upon delivery.

Other Computer Related Services

POSTED

DEADLINE

LexisNexis Instant ID & Waterfall Service MaintenanceThis subcontract provides software maintenance and support for LexisNexis Instant ID and Waterfall Email and Phone services to support prime contractors on Federal Deposit Insurance Corporation projects. The scope of work focuses on delivering active software maintenance agreements and licenses for identity and communication verification services, with a requirement that these provisions be co-termed. To be eligible, providers must be the Original Equipment Manufacturer or an Authorized LexisNexis Reseller or Partner. The contract falls under NAICS code 513210 and specifies Arlington, Virginia, as the place of performance.

Software Publishers

POSTED

DEADLINE

LexisNexis Bridger Insight XG Software MaintenanceThis subcontract provides software maintenance and support services for the LexisNexis Bridger Insight XG platform to support prime contractors working on Federal Deposit Insurance Corporation projects. The scope of work focuses on delivering an active software maintenance agreement and license to ensure the platform remains updated and fully supported in accordance with original equipment manufacturer standards through co-termed maintenance provisions. Eligible providers must be the original equipment manufacturer or an authorized LexisNexis Reseller or Partner. The performance of these services is centered in Arlington, Virginia, under NAICS code 513210. Interested parties must submit their responses by October 9, 2026.

Software Publishers

POSTED

DEADLINE

LexisNexis Bridger Insight XG InstantID & Waterfall Co-Term RFQ

Solicitation # CORHQ-26-Q-0314

The Federal Deposit Insurance Corporation (FDIC) is soliciting quotes under RFQ CORHQ-26-Q-0314 for a firm-fixed-price contract to provide co-termed software maintenance and support for LexisNexis Bridger Insight XG, InstantID, and Waterfall Email and Phone services. The procurement includes a base period running from November 2, 2026, to November 1, 2027, with two subsequent option periods that extend the final expiration date to November 1, 2029. The scope of work focuses on the delivery of software maintenance, including the provision of product keys, activation codes, digital certificates, and evidence of subscription renewals. Performance will be managed by the FDIC Oversight Manager, with a fifteen-business-day window for the agency to determine if deliverables comply with contract requirements. The FDIC will award the contract based on the Lowest Price Technically Acceptable (LPTA) method, evaluating offers first for technical acceptability and then selecting the lowest-priced responsive offer. Proposals must be submitted electronically to Tammy Mattox by October 9, 2026, and must be organized into five distinct volumes covering the price schedule, representations and certifications, license agreements, proof of authorized partnership or OEM status, and additional information. Awardees are required to maintain an active System for Award Management registration and submit invoices through the Invoice Processing Platform. This acquisition is not a small-business set-aside and requires strict adherence to general proposal instructions and federal non-discrimination and accessibility standards.

Software Publishers

POSTED

DEADLINE

SSL Certificate Provision and Subscription SupportThis subcontract for the Federal Deposit Insurance Corporation involves the provision of 265 DigiCert Inc. Secure Site Extended Validation SSL certificates and associated subscription maintenance support. Designed for prime contractors managing FDIC applications and websites, the contract leverages DigiCert and VeriSign infrastructure to maintain high-level security through rigorous verification tools. To be eligible, the provider must be a recognized Certificate Authority or an authorized reseller. The project is categorized under NAICS code 518210, with the place of performance located in Arlington, Virginia. The primary deliverables include the activation of all 265 certificates and the ongoing delivery of maintenance support.

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

POSTED

DEADLINE

Container Security Integration SpecialistThe Container Security Integration Specialist subcontract involves providing professional implementation and integration services for prime contractors supporting Federal Deposit Insurance Corporation software supply chain projects. The scope of work focuses on integrating container registry APIs into existing workflows, configuring enterprise management portals using SAML and OIDC authentication, and developing responses for ATO control statements to ensure an operational security environment. Based in Arlington, Virginia, this engagement requires the specialist to complete FDIC Directive 1360.16 training. The primary deliverables include a fully operational security environment and the completion of necessary ATO control documentation. The opportunity was posted on September 28, 2026, with a response deadline of October 9, 2026, falling under NAICS code 541512.

Computer Systems Design Services

POSTED

DEADLINE

Container Vulnerability Management & Patching ServiceThe Container Vulnerability Management and Patching Service is a subcontract for the Federal Deposit Insurance Corporation focused on securing software supply chain projects. The contractor is responsible for the continuous monitoring and rapid remediation of container vulnerabilities, specifically tracking zero-day threats with 48-hour updates. Adhering to NIST 800-190 standards, the service requires critical CVEs to be remediated within 7 days and high-severity CVEs within 14 days. To execute these requirements, the provider will utilize vulnerability scanning tools and automated CI/CD pipelines to deliver patched container images and detailed scan reports. The work is based in Arlington, Virginia, under NAICS code 541519. The solicitation was posted on September 28, 2026, with a response deadline of October 9, 2026.

Other Computer Related Services

POSTED

DEADLINE

Hardened Container Image Catalog ProviderThe Federal Deposit Insurance Corporation is seeking a subcontract for a Hardened Container Image Catalog Provider to support prime contractors on software supply chain projects. The selected provider will deliver a secure container image repository and a catalog of hardened images remediated to meet FedRAMP Moderate, NIST 800-190, and DISA STIG/CIS benchmarks. These images are intended for use across classified, SBU, and DoD IL5/IL6 environments. Technical requirements for the engagement include the provision of a container registry with API access and an enterprise management portal. This opportunity is categorized under NAICS code 513210, with the place of performance located in Arlington, Virginia. Responses are due by October 9, 2026.

Software Publishers

POSTED

DEADLINE

Ready to Pursue This Opportunity?

Get AI-powered intelligence on this solicitation and the ones like it

Every page of the solicitation package shredded into a compliance breakdown

AI-powered matching based on your capabilities and past performance

Competitor and incumbent history on the requirement

Automated alerts on amendments, Q&A deadlines, and award

Join 750+ contractors already using CLEATUS