Call_for_Solutions_(CFS)__ICT-SCRM_Illumination_Tool.pdf

Call for Solution (CFS) Information and Communications Technology (ICT)

Supply Chain Risk Management (SCRM) Monitoring Tool

Project Number W519TC-26-R-SCRM

Open Solicitation Number W9128Z-25-S-A002

Call for Solution Title Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Monitoring Tool

Issued By Capability Program Executive (CPE) Enterprise Software & Service (ES2) Product Lead (PL) Digital Market (DM)

Submission Instructions To respond to this Call for Solution, please refer to Sections 6 and 7 of this Call for Solution.

*Solution Briefs Due Date/Time (Suspense)

(09 SEP) 2026 at 1200 Eastern Standard Time

Submit Solution Brief To Contracting Officer: Corene.n.feddersen.civ@army.mil Specialist: megan.e.haffey.civ@army.mil

Note: Please advise the Cognizant Contracting Officer and Specialist as soon as possible via the email above if your organization intends to submit a Solution Brief to DM in response to this Call for Solution.

*Any submissions that are received by the Contracting Officer after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the company to ensure that its submission is received in the inbox listed above before the deadline specified.

This Call for Solutions (CFS) may result in the Government awarding a contract using full and open competition in accordance with 10 U.S.C. § 3201. This CFS, and any resulting contract award, is subject to the Revolutionary FAR Overhaul (RFO) Part 12, Defense FAR Supplement

(DFARS) Part 212, and its applicable agency supplements

This solicitation is associated with the Army's Open Solicitation, W9128Z-25-S-A002. Please see the referenced link for more information.

https://sam.gov/opp/476c4481dc56499c9b1d9c6a9ce745a9/view

1.0 Objective and Overview

1.1 Purpose and Strategic Alignment

The Government is seeking information and technical white papers for a Supply Chain Risk Management (SCRM) illumination and continuous monitoring software tool. This procurement directly supports the operationalization of the Department of the Army Memorandum: Army Information and Communications Technology Supply Chain Risk Management Strategy (SAAL-ZS-E, 20 July 2026), co-signed by the Assistant Secretary of the Army (Acquisition, Logistics and Technology) (ASA(ALT)) and the Army Chief Data and Analytics Officer (CDAO).

This strategy mandates a decisive shift from disconnected, compliance-based activities toward an integrated, operationalized framework designed to accelerate the delivery of secure capabilities to the warfighter at the "speed of relevance."

Specifically, this CFS executes Strategic Line of Effort (LOE) b: Trusted Marketplace through Illumination. The Army is enhancing its procurement channels, starting with the Product Lead (PL) Digital Market (formerly Computer Hardware, Enterprise Software and Solution (CHESS)), by implementing supply chain illumination and protection tools. The objective is to continuously vet vendors and products for compliance, cybersecurity vulnerabilities, and Foreign Ownership, Control, or Influence (FOCI) both pre- and post-contract award.

The selected SCRM tool will enable a trusted marketplace procurement model. By pre-vetting vendors, software, and hardware components, the Army aims to:

• Reduce friction in the acquisition process.

• Shorten Authority to Connect (ATC) timelines.

• Deliver secure, modernized Commercial Off-the-Shelf (COTS) IT hardware, software, and services to Soldiers faster.

• Mitigate critical, unacceptable supply chain risks to the network and mission (such as those highlighted by recent Army Audit Agency (AAA) findings).

1.2 Core Operational Use Case

To support the Army's managed Indefinite Delivery, Indefinite Quantity (IDIQ) contracts for IT

Hardware, Software, and Services, including all current and future contract vehicles, the platform must serve as an automated, continuous surveillance and compliance engine. It will continuously monitor high-volume vendor catalogs and corporate structures, using robust API integrations to feed real-time risk scores into the Digital Market IT e-Mart portal while establishing streamlined workflows to hand off complex technical risks to a separate, dedicated SCRM analysis team.

2.0 Scope

The Government requires a Commercial-off-the-Shelf (COTS) software platform or Software-as-a-

Service (SaaS) tool as the core of this requirement. The platform must be directly operable by

Government personnel and integrated into existing procurement portals (e.g., Army CHESS / Digital

Market) via API.

Core vs. Supplementary Offerings:

• Mandatory Core: A user-operable software interface, self-service configuration, and automated, API-driven data delivery.

• Allowed Supplementary Services (Optional Add-ons): Vendors are encouraged to detail any associated professional services they offer in addition to the software platform. For each service option listed, vendors must explicitly state whether the capability is bundled (included in the base software licensing fee) or supplementary (requiring additional/separate funding or licensing tiers). This may include:

• Specialized analyst-on-demand support for complex risk escalations or deep-dives.

• System integration, API custom-engineering, and onboarding services.

• Specialized threat reports or periodic forensic assessments of sub-tier suppliers.

• Prohibited Offerings (Non-Compliant): This CFS is not seeking "services-only" consultancies or Managed Service Providers (MSPs) where risk analysis is strictly conducted manually by the vendor and delivered via static PDF/slides without a self-service software tool. Any response proposing a services-only model without a core user-operable software platform will not be evaluated.

3.0 Awarding Instrument

This CFS will be awarded in accordance with DFARS 212.70 and the Army Open Solicitation (AOS) procedures detailed within the Solicitation W9128Z-25-S-A002 and all associated attachments. The

Army Open Solicitation outlines the guidelines for submitting Solution Briefs, pitches, and proposals and how the Government will evaluate responses to this CFS.

4.0 Solicitation Notes

In addition to the general guidelines included in the AOS, the following guidelines apply to this CFS.

• Offerors are responsible for monitoring SAM.gov for any amendments that may be issued to this solicitation for updated information.

• The Government reserves the right to make more than one (1) award resulting from this CFS or to make no award.

• The Government reserves the right to make an award(s) without discussions or clarifications.

5.0 General Information, Industry Day, and Questions

5.1 Industry Day

The Government will host a virtual Industry Day to provide a detailed overview of the ICT SCRM

Monitoring Tool requirement and answer questions from potential offerors. For details, please visit the following link: https://www.army.mil/enterprise#org-events

5.2 Questions

Questions are to be sent only to the Contracting Officer and Specialist (POCs) listed in this Call for

Solution. The following shall be utilized in the email subject line: Call for Solution –ICT SCRM

Illumination Tool Questions. Only one (1) round of questions will be accepted, no exceptions will be granted. The final deadline to submit all written questions is 28 August 2026. Material questions and answers will be published and updated on www.sam.gov via an amendment to this CFS.

6.0 Submission Requirement

Companies responding to this call shall submit a Solution Brief for evaluation. Submissions are to be sent via email only to the Contracting Officer and Specialist (POCs) listed in this Call for Solution.

The Government will utilize up to two (2) phases for assessing solutions.

Interested vendors must submit a unified response package consisting of two mandatory parts described in Phase 1 below:

a. Phase 1: Solution Brief (Open to All Offerors). Responding companies must submit an initial, unified Phase 1 package consisting of two mandatory parts:

• Part A: Technical White Paper: A highly focused technical document detailing how the vendor's software addresses the five core operational areas.

• Part B: Recorded Video Demonstration: A secure online streaming link containing a recorded walk-through showing the live software platform executing key workflows.

b. Phase 2: Request for Solution Proposal (By Invitation Only). Following the evaluation of

Phase 1 Solution Briefs, the Government will down-select highly qualified offerors. These

Submission deliverables must comply with the precise formatting, media, and delivery instructions outlined in Section 7 below.

7.0 Submission Formatting and Content

7.1 Part A: Technical White Paper Guidelines

• Page Limit: Maximum of seven (7) pages (excluding cover page and Table of Contents).

• Format: Searchable PDF format, 11-point Cambria font, single-spaced with standard 1-inch margins.

• Prohibitions: General corporate marketing material, boilerplate history, and glossy brochures will not be reviewed. Responses must strictly follow the headers below.

• Hyperlinks are not permitted.

http://www.sam.gov/

7.2 Media Format and Security Delivery Instructions

• Delivery Method: The recorded demonstration must be submitted exclusively as an unlisted YouTube link. Direct uploads of raw MP4 or other video files, as well as password-protected files or external cloud sharing links (such as Google Drive or Dropbox), will not be accepted.

• Duration: The video must not exceed 15 minutes in length.

• Data Content: The demonstration must utilize vendor-provided mock data representing typical commercial IT catalogs. No actual Government data will be provided for this effort.

• Access Requirements: The provided YouTube video must be configured as unlisted so that it is not searchable by the public, but it must remain active and accessible to Government evaluators for the duration of the evaluation period. Because the video contains non-sensitive mock data, no additional security controls or password protection are required.

• Operational Sequence & On-Screen Marker: The video demonstration is not required to follow the strict sequence of the Technical White Paper headers. Instead, vendors are encouraged to present a logical, user-friendly end-to-end operational story. However, to ensure evaluation consistency, the video must include on-screen titles, "chapter" transition slides, or persistent burn-in text identifying which Evaluation Factor / Header is being demonstrated.

7.3 White Paper & Video Structure

Vendors must organize their White Papers using the exact headers below. To ensure evaluation consistency, the 15-minute Recorded Video must dedicate a portion of its run-time to demonstrate these identical capability areas in a live software environment:

Factor 1: System Architecture & API Integration

• White Paper Technical Detail: Provide detailed technical specifications on your RESTful

APIs, describing the data format/schema (JSON/XML), transmission frequency, and integration pathways. Clearly state your current Department of War (DoW) or Federal hosting authorization status (e.g., IL2, IL4, IL5, FedRAMP equivalent, or commercial cloud).

Describe your platform's technical architecture, data flow boundaries, and secure integration pathways (such as the capability to push risk telemetry natively to a

Government-controlled Secure API Gateway or proxy under a zero-trust model without requiring direct inbound network tunnels to the vendor’s hosting environment).

Additionally, state your capability to provide a standard Software Bill of Materials (SBOM) for your own software platform to facilitate the Government's ongoing risk monitoring of the tool itself.

• Video Demonstration: Demonstrate how risk scores, compliance flags, and continuous alerts are pushed out of your platform into external systems, showcasing the compatibility of the data output with the Army's Digital Market / IT e-Mart.

Factor 2: Automated Catalog Ingestion & Regulatory Vetting (HW & SW)

• White Paper Technical Detail: Describe the technical process for ingesting, normalizing, and continuously screening massive (10,000+ SKU) hardware and software catalogs submitted in standard CSV or XML formats. Detail how the platform automatically flags

Trade Agreements Act (TAA) origin violations, anti-counterfeit concerns, and enforcement of prohibited sources such as NDAA Section 889 and 1260h compliance risks without manual analyst intervention. Explain the underlying mechanics of how your platform automatically identifies and verifies true Original Equipment Manufacturer (OEM) origins or software publishers.

• Video Demonstration: Showcase the live system ingesting a high-volume product catalog, automatically identifying the true OEM or software publisher, and triggering real-time compliance alerts (TAA, NDAA 889, etc.) without administrative intervention.

Factor 3: Continuous Corporate Monitoring (Services & Primes)

• White Paper Technical Detail: Explain how the platform continuously monitors prime contractors and evolving sub-tier service providers for Foreign Ownership, Control, or

Influence (FOCI), Ultimate Beneficial Ownership (UBO), Software Bill of Materials (SBOM), Hardware Bill of Materials (HBOM), Known Vulnerability (CVE), Mergers & Acquisitions, and corporate health risks. Explain the methodology for dynamically adding or removing fluid sub-tiers as task orders evolve.

• Video Demonstration: Walk through a live vendor corporate risk dashboard, showing how the tool maps corporate hierarchies, highlights foreign influence nodes, and allows the dynamic management of subcontractor lists.

Factor 4: Workflows, Alert Management, & Handoffs

• White Paper Technical Detail: Describe the platform's role-based access controls and false-positive alert tuning mechanisms to prevent alert fatigue for contract specialists.

Detail your case-management capabilities and the workflows used to package, escalate, and hand off complex alerts.

• Video Demonstration: Walk through the specific step-by-step workflow an Acquisition or

Contracting Officer would use to review an automated risk alert, leverage the interface's dashboards (such as red, yellow, and green status indicators), and package/route a complex supply chain alert to an external technical SCRM team for deep-dive analysis.

Factor 5: Supplementary Analyst & Support Services

• White Paper Technical Detail: Describe any professional services, analyst support networks, custom API engineering, or paid help-desk support options your company provides to support the software. For all support models described, the vendor must explicitly detail the geographic location and US citizenship status of support personnel, as well as their protocols for secure troubleshooting and handling system diagnostics For each service described, clearly specify whether it is fully included in the base platform subscription or if it represents a supplementary cost requiring separate funding.

• Video Demonstration: Show how government personnel interact with your technical services team or submit an escalation request when a complex supply chain risk flagged by the tool requires manual investigation.

Rough Order Magnitude (ROM)

• White Paper Technical Detail: Outline the complete pricing model for the core software platform (e.g., enterprise flat rate, user-based, or volume-based pricing). Clearly distinguish between what is covered by the core software licensing costs and what requires supplementary, separate service-tier pricing. The ROM will cover one twelve-month base and four, twelve-month options.

• Video Demonstration: Not applicable for this header; vendors may focus their remaining video run-time on strengthening the live demonstrations in Headers 1 through 4.

Note the ROM will not be included as part of the evaluation criteria.

8.0 Phase 1 Evaluation Criteria

The Government will evaluate the combined White Paper and Recorded Video package based on the following criteria:

8.1 Gateway Compliance Criteria

Submissions must receive a "Pass" rating on all five (5) binary compliance gates to proceed to the qualitative technical evaluation. Any "Fail" rating on any single criterion will result in immediate disqualification of the entire submission package without further review.

Gateway Criterion Evaluation Standard for a "Pass" Rating Rating

1. Completeness The vendor submitted both deliverables: Part A (Technical White Paper) and Part B (Unlisted YouTube Demonstration Link).

Pass / Fail

2. Administrative Formatting

The Technical White Paper strictly complies with the page limit of seven (7) pages or fewer (excluding cover page) and is formatted in 11-point Cambria font with 1-inch margins.

Pass / Fail

3. Core Software Availability

The submission clearly offers an existing, user-operable COTS or SaaS software product that can be independently operated by Government personnel.

Pass / Fail

(Services-only, consulting-only, or custom-development proposals will receive a Fail rating).

4. API Integration Readiness

The vendor documents and confirms the existence of functional, documented RESTful APIs capable of exporting risk telemetry and compliance data.

Pass / Fail

5. Video Demonstration Compliance

The video is provided strictly as an active unlisted YouTube link, does not exceed the fifteen (15) minute run-time limit, and demonstrates actual screens of the operational software utilizing mock data (no conceptual slideshows).

Pass / Fail

8.2 Phase 1 Technical Evaluation Factors (Weighted)

8.2.1 Factor 1: System Architecture & API Integration (35%)

The Government will evaluate the maturity, completeness, and documentation of the vendor's

RESTful APIs. This includes assessing the platform's demonstrated capability to push continuous alerts, risk telemetry, and compliance flags natively into external portals, such as the IT e-Mart. The

Government will also evaluate the completeness, accuracy, and format of the vendor's provided

Software Bill of Materials (SBOM) for their own software platform to facilitate ongoing government risk monitoring of the tool itself. Vendors must clearly state their current Department of War

(DoW) hosting authorization status (e.g., IL2, IL4, IL5, FedRAMP equivalent, or commercial cloud) and describe their platform's technical architecture, data flow boundaries, and integration pathways to support secure network enclaves.

8.2.2 Factor 2: Automated Catalog Ingestion & Regulatory Compliance Vetting

(25%)

The Government will evaluate the platform's capability to ingest, normalize, and continuously screen high-volume CSV or XML product catalogs and automatically identify true Original

Equipment Manufacturer (OEM) or software publisher origins. Assessments will focus on the accuracy and automation level of the tool in flagging TAA origin, anti-counterfeiting indicators, and enforcement of prohibited sources (i.e. NDAA Section 889 and Section 1260h compliance risks)without requiring manual data entry or administrative intervention.

8.2.3 Factor 3: Continuous Corporate Monitoring (20%)

The Government will evaluate the tool's capability to maintain continuous surveillance of prime contractors and multi-tier sub-tier vendors. This includes assessing how effectively the platform monitors and triggers automated alerts for sudden changes in FOCI, UBO, SBOM, HBOM, CVE, M&A and corporate health risk. as well as the platform’s analytical visualization capabilities (including hierarchical mapping and foreign influence node highlighting. Additionally, the Government will evaluate how easily the tool handles fluid service-provider subcontractor lists as task orders evolve.

8.2.4 Factor 4: Workflows, Alert Management & Handoffs (10%)

The Government will evaluate the design and operational usability of the software interface for non-technical procurement professionals, looking for simple, intuitive executive-level dashboards

(such as red, yellow, and green status indicators). This includes assessing the ease and efficiency of case-management features used to package, escalate, and handoff complex alerts to separate technical analysis teams. Additionally, the Government will evaluate the maturity of the platform’s role-based access controls (RBAC) and the effectiveness of its false-positive alert tuning mechanisms designed to prevent alert fatigue.

8.2.5 Factor 5: Supplementary Analyst & Support Services(10%)

The Government will evaluate the quality, scope, and responsiveness of the vendor's supplementary technical support and professional analyst-on-demand offerings. Vendors must detail their technical support model, including the geographic location and citizenship status of support personnel, as well as their protocols for secure troubleshooting and handling system diagnostics. Assessments will prioritize vendors who provide high financial transparency by explicitly separating core software pricing from optional, add-on services.

8.3 Scoring Methodology

Each evaluator will independently assign a raw score of 1 to 5 for each Technical Evaluation Factor based on the rubric below. Each evaluator's raw factor score will then be multiplied by that factor’s percentage weight to determine their individual weighted score. To aggregate the results of the evaluation panel, the individual weighted scores from all evaluators will be averaged to produce a single composite technical score (on a 1.0 to 5.0 scale) for each offeror, which will map directly back to the corresponding adjectival rating to establish the baseline for the final consensus evaluation.

The Government will evaluate Technical Evaluation Factors 1 through 5 using the adjectival rating definitions and numerical scores outlined in the table below.

Rating Score Definition

Outstanding 5 Proposal indicates an exceptional approach and understanding of the requirements. The proposed solution is characterized by significant positive attributes that highly benefit the Government, with no negative attributes. Risk of unsuccessful performance is very low.

Good 4 Proposal indicates a thorough approach and understanding of the requirements. The proposed solution contains multiple positive attributes that benefit the Government and is not offset by negative attributes. Risk of unsuccessful performance is low.

Acceptable 3 Proposal indicates an adequate approach and understanding of the requirements. The proposed solution meets the baseline requirements. Positive attributes generally balance out any minor negative attributes. Risk of unsuccessful performance is moderate.

Marginal 2 Proposal has not demonstrated an adequate approach and understanding of the requirements. The proposed solution has one or more significant negative attributes that are not offset by positive attributes. Risk of unsuccessful performance is high.

Unacceptable 1 Proposal does not meet the requirements of the solicitation. The proposed solution is dominated by critical negative attributes or severe operational deficiencies. The proposal is unawardable. Risk of unsuccessful performance is unacceptable.

8.4 Definitions

• Positive Attribute: An aspect of a proposal that has merit, exceeds specified performance or capability requirements, or offers an advantageous technical feature that benefits the

Government's continuous SCRM mission.

• Negative Attribute: A flaw, gap, or limitation in the proposed software or approach that increases the risk of unsuccessful contract performance, integration failure, or security non-compliance.

• Deficiency: A critical negative attribute representing a material failure of a proposal, rendering the solution unviable.

9.0 Phase 1 Outcomes and Transition to Phase 2

The Government will inform the offeror of one of the following outcomes:

a. The Government has decided not to move forward with the submitted Solution.

b. The Government will issue a Request for Proposal (RFP)

The Government reserves the right to invite one or more highly rated offerors to participate in

Phase 2 of this evaluation process. The RFP will have specific guidelines. Offerors will be expected to submit a statement of work and a detailed pricing proposal expanding upon the pricing structures provided by Header 6. If negotiations are held and an offeror fails to result in mutually agreeable terms, the Government reserves the right to terminate discussions with that offeror and invite the next highest ranked qualified offeror from Phase 1 to submit a Phase 2 proposal.

10.0 Appendix A: Applicable Policies and Guidance

The following policies, directives, and guidance documents establish the foundational requirements and strategic context for the Army Information and Communications Technology Supply Chain Risk

Management (ICT-SCRM) Illumination Tool. Offerors should ensure their proposed solutions align with the principles and mandates outlined in Appendix A attachments.

• Memorandum: Army Information and Communications Technology Supply Chain Risk

Management Strategy, 20 July 2026.

• Memorandum: DoD Commercial Off the Shelf (COTS) Information and Communications

Technology Supply Chain Risk Management, 09 June 2025

• Memorandum: Enhanced Section 806 Procedures for Supply Chain Risk Management in

Support of DoD Trusted Systems and Networks, 13 March 2018