Addendum 2 Cyber Security and Supply Chain IFB 2026.pdf

EASTERN SHORE OF VIRGINIA BROADBAND AUTHORITY

Addendum#2: Cybersecurity requirements

ESVBA fully adheres to the cybersecurity and supply chain requirements by DHCD and NTIA. ESVBA is committed to protecting its employees, partners, and customers from damaging acts that are intentional or unintentional. ESVBA is committed to protecting systems, including physical and virtual technology and services such as computing devices, servers, network devices, and applications. Protecting company data and the systems that collect, process, and maintain this information is of critical importance. Consequently, the security of systems must include controls and safeguards to offset threats, as well as controls to ensure accountability, availability, integrity, and confidentiality of the data.

Cybersecurity risk in supply chains refers to the potential for harm or compromise that may arise from suppliers, their supply chains, their products, or their services. Cybersecurity risk in supply chains is the result of threats that exploit vulnerabilities or exposures within 1) products and services that traverse supply chains; or 2) supply chains themselves.

In performance of this IFB, the bidder agrees to comply with the following cybersecurity and supply chain requirements and assumes responsibility for compliance:

1. Mandatory Security Addendum All master services agreements and procurement documents, for the Eastern Shore of Virginia Broadband Authority, must include a Security Exhibit, Security Schedule, or Security Addendum.

• Technical Controls: The bidder must agree to meet controls aligned with NIST SP 800-53, covering areas like access control, patch management, and vulnerability remediation.

• Data Protection: Terms must specify that any ESVBA or customer data handled by the supplier must be encrypted and protected per NIST standards.

2. Supply Chain Transparency & Risk Assessment

• Risk Questionnaires: Bidders must agree to complete security questionnaires and risk assessments during the due diligence phase.

• Banned Suppliers: Include a "Certificate of Eligibility" stating the bidder and their sub-suppliers are not on the International Trade Administration Consolidated Screening List.

• FOCI Disclosure: Bidders must disclose any Foreign Ownership, Control, and Influence (FOCI) that could result in increased security risk.

• Sub-supplier Visibility: The bidder should be required to provide a "Bill of Materials" (BOM) for third-party components within their products.

3. Operational & Lifecycle Requirements

• Supply Chain Event Notification: The contract must require the supplier to notify the ESVBA

CSCRM Team of any "Supply Chain Event" or vulnerability within a specified timeframe.

• End-of-Life (EOL) Data Erasure: Terms must specify that equipment can be wiped to DoD standards or destroyed to industry standards at the end of its life cycle.

• Right to Monitor: Include a clause allowing ESVBA to perform at least annual reviews of the supplier's SCRM documentation and site visits if necessary.

4. Role-Specific Coordination Ensure the IFB reflects the internal approval workflow defined in your plan:

• Pre-Purchase Vetting: Explicitly state that the award is contingent upon vetting and approval by the

ESVBA CSCRM Team.

• Legal Review: Ensure the ESVBA Legal Team reviews the final contract to confirm all supplier responsibilities are properly articulated as required by your policy.

Bidders may refer to key practices discussed in the NIST publication NISTIR 8276, Key Practices in Cyber Supply Chain Risk Management: Observations from Industry and related SCRM guidance from NIST and NIST 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Bidders may also refer to the latest version of the NIST CSF (currently 2.0) and the standards set forth in Executive Order 14028