Vulnerability Disclosure and VEX Reporting

The contract involves monitoring software for critical vulnerabilities, requiring the contractor to identify and report any such vulnerabilities within 12 hours of detection. Additionally, the contractor must produce Vulnerability Exploitability eXchange (VEX) reports within three calendar days to assist in assessing the exploitability of identified vulnerabilities. The effort is structured as a subcontract under the NAICS code 541690 and is issued by the US Embassy in Phnom Penh, managed through the Department of State. The solicitation was posted on June 3, 2026, with a response deadline set for June 17, 2026. This contract emphasizes timely vulnerability disclosure and thorough reporting to ensure rapid assessment and mitigation of software risks. By providing fast notification and detailed exploitability reports, it supports maintaining the security and integrity of software systems. The place of performance is Phnom Penh, where the monitoring and reporting activities will be executed, contributing to cybersecurity efforts aligned with the Department of State’s operational needs.