Supply Chain Illumination RFI

The FBI is seeking industry input through a Request for Information (RFI) to identify commercially available technologies capable of enhancing its enterprise Supply Chain Risk Management (SCRM) capabilities for information and communication technology (ICT) products, software, and services. The goal is to acquire tools that provide deep visibility into supply chain threats, vulnerabilities, and risks, with specific requirements for micro-component traceability, comprehensive Software Bill of Materials (SBOM) and Hardware Bill of Materials (HBOM) breakdowns, mapping of supply chain relationships across three upstream tiers, and reliable, verifiable vendor and product data. Responses must be submitted as a single capability package not exceeding twenty one-sided pages in Microsoft Word, Excel, PowerPoint, or PDF format, with all content unclassified and submitted via email by 3:00 PM Eastern Time on May 6, 2026. The RFI is solely for market research under FAR 15.201(e) and does not constitute a solicitation or binding commitment to award a contract. The evaluation of capabilities will focus on a broad range of supply chain risk elements including financial instability, foreign ownership or influence, operational ties to foreign entities, cybersecurity vulnerabilities, governance noncompliance, third-party dependencies such as white-label products or embedded open-source software, and trade compliance issues. Proposed solutions must align with NIST SP 800-161, FIPS 199, FedRAMP High, Executive Order 14028, and the Trade Agreements Act (TAA), and must support air-gapped deployments, integration via open APIs and standardized data formats, and generation of actionable risk insights with configurable alerts and exportable reports. Systems must be deployable in FedRAMP High-authorized environments and comply with Section 508 accessibility standards. While no contract value, pricing, or line items are specified, vendors are expected to provide Rough Order of Magnitude (ROM) cost estimates. The FBI’s Supply Chain Risk Management Unit will lead risk assessments, and contractors must not submit proposals or proprietary information, ensuring responses remain strictly informational. The place of performance is Clarksburg, West Virginia, with the contracting office located in Washington, D.C., and no formal contract clauses, award basis, or payment details are part of this RFI.