Software Bill of Materials (SBOM) Generation and Management

The contract requires the generation and ongoing maintenance of Software Bill of Materials (SBOMs) in either SPDX or CycloneDX format, with full integration into continuous integration and continuous delivery pipelines as well as vulnerability management systems. The deliverables must ensure accurate, up-to-date component tracking to support security compliance, risk assessment, and patch management across all software assets. Work must be performed in alignment with industry best practices for automated SBOM creation and must be seamlessly compatible with existing tooling and workflows used for software supply chain security. This is a subcontract under the Federal Retirement Thrift Investment Board, with a NAICS code of 541511 indicating software development and related services. The solicitation was posted on July 9, 2026, and responses are due by July 15, 2026. The performance location is designated as Washington DC, with a zip code of 20002. While no point of contact or set-aside details are provided, the contract emphasizes technical execution in automated software composition analysis and secure coding practices, positioning the performer as a critical node in the federal agency’s software integrity and cybersecurity infrastructure.