Software Bill of Materials (SBOM) Validation Comparison Set

The U.S. Food and Drug Administration, through the Office of Acquisitions and Grants Services and the Center for Devices and Radiological Health, intends to award a firm fixed price purchase order to MedCrypt, Inc. for a Software Bill of Materials validation comparison dataset. This procurement, identified by solicitation number 75F40124P00413 and classified under NAICS code 541511 for Custom Computer Programming Services, is being conducted as a sole-source acquisition under FAR subpart 6.302-1 because MedCrypt is determined to be the only reasonably available source for these specific services. The contract provides a data subscription service that delivers vulnerability data and alias files essential for automating the analysis of Software Bill of Materials for medical devices. By reporting known cybersecurity vulnerabilities, risks, and exploitations, this service enables the FDA to better identify potential threats and ensure the safety and effectiveness of medical devices. The scope of work includes critical tasks such as dataset integration, encryption, and the processing of package analysis requests to support the agency's cybersecurity oversight.