SCRM Platform - Final.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

REQUEST FOR INFORMATION FOR SUPPLY CHAIN RISK

ILLUMINATION

REQUEST FOR INFORMATION (RFI)

SUPPLY CHAIN RISK ILLUMINATION

3/24/2026

REQUEST FOR INFORMATION (RFI) FOR SUPPLY CHAIN RISK

Supply Chain Risk Illumination - Request for Information (RFI)

Version 1.2 Page 2

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL

OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND MUST NOT BE CONSTRUED AS A

COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS

ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO

THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL

DESCRIPTION IS STRICTLY VOLUNTARY.

INTRODUCTION

The Federal Bureau of Investigation (FBI) is issuing this Request for Information (RFI), as defined in FAR 15.201(e). The Government is requesting information regarding the availability and capability of those companies who can provide software and services to meet the FBI’s Supply Chain Risk Illumination requirement for securely procuring supplies and equipment. Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The description below outlines preliminary requirements envisioned for the Supply Chain Risk Illumination. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

BACKGROUND

The purpose of this RFI is to obtain industry input regarding commercially available technologies capable of supporting an enterprise Supply Chain Risk Management (SCRM) capability for illuminating information and communication technology (ICT) products, software, and services.

The FBI seeks to identify SCRM illumination tools capable of providing detailed insights into the threats, risks, and vulnerabilities to commercially available ICT products as it relates to the supply chain. The FBI requires detailed insights to include micro component traceability, software bill of materials (SBOM) breakdowns, supply chain relationship mapping, and reliable product and vender information. This RFI is issued solely for information and planning purposes and does not constitute a solicitation.

The Supply Chain Risk Management Unit (SCRMU) – under the FBI’s Office of the Chief Information Officer (OCIO) – is responsible for SCRM associated with the procurement, deployment, and lifecycle management of information technology systems and services.

Current SCRM processes rely heavily on manual governance processes and documentation, with limited structured data or centralized inventory visibility to perform risk assessments.

Version 1.2 Page 3

Requirements of the RFI:

The FBI’s SCRM program is governed by federal regulating authorities to include the NIST SP 800-161 and NIST SP 800-53 which require a systematic approach for managing exposure to cybersecurity risks throughout the supply chain to include vetting prior to purchase and continuous monitoring for threats that occur once the product has been integrated into and implemented within the IT enterprise. Additional federal SCRM requirements and authorities are captured within:

• Title 40 United States Code (U.S.C. Section) 11101-11704, Clinger-Cohen Act of 1996

• 44 U.S.C. Chapter 41, E-Government Act of 2002

• 44 U.S.C. Chapter 35 Sections 3551-3556, Federal Information Security Modernization Act

(FISMA) of 2014

• Executive Order 14017, America’s Supply Chains

• Executive Order 14028, Improving the Nation’s Cybersecurity recommends cybersecurity measures to augment existing NIST 800 161 controls. EO 14028 recommends software supply chain concepts and capabilities that include a Software Bill of Materials (SBOM), enhanced vendor risk assessments, open-source software controls, and vulnerability management practices.

• Executive Order 13873, Securing the Information and Communications Technology and Services Supply Chain, directs the federal government to strengthen efforts to prevent foreign adversaries from exploiting vulnerabilities within the ICT supply chain. It also seeks to protect the vast amount of sensitive information being stored in and communicated through ICT products and services.

• ICD 731-01 requires criticality assessments via an end-to-end functionality review to identify critical functions and components based on potential harm caused by the probable loss, damage, or compromise of an ICT product, material, or service to an organization’s operation or mission.

The FBI requests capability statements from manufacturers with expertise in IT supply chain risk illumination within the federal government, particularly in the areas of reliable information that provides relevant and actionable risk information based on ICT products and vendors. The intent of this RFI is to obtain information that will assist the FBI in determining and scaling its market request and technical requirements for appropriation solutions that can be integrated into FBI infrastructure. The FBI is looking for information that helps avoid data and process silos, provide reliable and actionable ICT product and company information, streamline risk assessment workstreams for efficiency, and support resiliency of the enterprise against emerging supply chain threats.

Version 1.2 Page 4

To execute continuous monitoring with the FBI’s SCRM program, an illumination tool must provide and manage alerts to FBI staff when indicators appear in any of the various data sources (continuous monitoring). Use cases for the continuous monitoring tool must include:

• Continuous Monitoring – monitoring the level of risk presented by a given product or entity and tracking any factors that could change the level of risk over time. This also includes notifying a user of any changes in the level of risk.

• Due Diligence – illuminating the supply chain of a product, vendor or entity in-depth, to allow an initial risk assessment and mitigation plan to be performed.

• Automatic Alerts – for changes in risk ratings, or product, vendor or entity status changes.

• Management and Tasking Features – for internal and external communications that must be automated or scheduled.

• Visualizations – automated or easily customizable visuals and data that must be exported from the tool for briefings or further analysis.

• Record Keeping – Grouping product, vendor or entity types in categories for easy access and coordination.

• Supply Chain – The tool must be able to map the supply chain at least three tiers upstream, to track 3rd party risks.

• Structured product/vendor registries

• Supply chain relationship mapping

• The ability to integrate with FBI enterprise systems

• Customer alerts and status notifications from illumination

• Data visualization and exportable reporting

• Supply chain Bill of Materials breakdowns

• Micro component traceability functionality

• Shipping/transport records

The following are required supply chain risk management factors that should be components of any identified potential solution.

• Financial Risks o Degree of foreign ownership, funding, control or influence over a company’s operations; a history of poor financial performance

• Operational Risks o Poor supplier relationships, operating in foreign countries, or close operational relationships with foreign suppliers or entities

• Cyber Risks

Version 1.2 Page 5 o Breaches, leaks, backdoors, hacks, or other cybersecurity events that have created vulnerabilities for entities or their partners in the past or currently; known cybersecurity vulnerabilities of products.

• Governance Risks o Lack of certification or poor performance for complying with regulations or internal risk management mitigations

• Third-Party Risk o Identify white label products, embedded open-source software (OSS) and dependency, associate third party component with parent companies and affiliates, tier 2 and tier 3 supply chain risk

• Trade Risk o Material contracts including contracts with foreign influence are identified, categorized, and documented

• Product Risk o Hardware - Use of tampered or counterfeit components or micro components; not using Trade Agreement Act (TAA) compliant components; incomplete product testing o Software –The use of source code, open-source dependencies, CI/CD pipeline exposure, build and artifact integrity failures, secrets and credential leakage, cloud infrastructure, and third-party services

The solution must include Application Programming Interfaces (APIs) that can be integrated with FBI procurement and asset management systems. The recommended solutions must be FedRAMP high approved to be integrated with these systems.

CONTRACTOR QUALIFICATIONS

This RFI is open to manufacturers for market research only to request input from potential providers of data management solutions that provide hardware, software and purchase new software licenses, training, and remote consulting services. Section 508 requires that Government Agencies ensure that their software is accessible by those with disabilities. This requirement requires all products to be 508 compliant. As part of our market research, the FBI seeks information pertaining to potential providers of IT supply chain risk illumination software and/or services tools/capabilities approved for implementation on federal systems.

The Government would like to know which manufacturers can provide the services and/or products for this contemplated requirement by identifying themselves and responding to this RFI. The Government may request demonstrations based on the results of this RFI. The Government requests the following information:

Version 1.2 Page 6

1. Provide evidence to show that your company can provide the requested services and/or products required (i.e. technical ability, personnel, and experience). Information provided must be succinct and related to the requested information in this RFI. All submissions must be unclassified.

2. Address whether your company has a GSA Schedule and if they are capable of providing these services on schedule. If able to provide the services on schedule, provide the schedule and SIN.

3. Provide any authorized resellers, if those resellers are available on GSA or NASA SEWP, are they small/large and what is their SIN on GSA or NAICS on SEWP.

4. Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

Required Information:

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

DUNS Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

NASA SEWP Contract:

CONTEMPLATED REQUIREMENT

The FBI's OCIO, SCRMU is issuing this RFI to gather information about supply chain illumination products that can completely fulfill or complete the following requirements:

• Insights into the architecture and configurability of the illumination product with an understanding of how the product can be maintained within FBI control (e.g., updating a dropdown value).

• Illumination capabilities that operate independently of a completed software/hardware inventory and do not require to enter ICT asset data into a system that is not contained within either an FBI network or secured government cloud.

• Illumination and data access capabilities that provide an end user with direct access to exportable and exploitable information about ICT companies and products where search results can be used as artifacts in risk assessment reports.

Version 1.2 Page 7

• Illumination capabilities that encapsulate full company ownership and business transactional relationships (i.e., shipping, foreign ownership) in an exploitable and exportable format beyond data visualization.

• Illumination and dataset capabilities that include reliable data assets such as vulnerability databases (i.e., CVE, CWE) where historical data is clearly indicated to an analyst for context and exploitability.

• Illumination and data capabilities that include the ability to generate ICT components (i.e., SBOMs for software, micro components for hardware).

• Illumination systems that include notifications or system alerts related to relevant and configurable risk concerns and findings.

• Illumination capabilities that have built in interface capabilities or readily available data pipelines that would allow for integration with FBI data systems to include those on different network enclaves.

# Domain Area Question

1. Product Information Please describe your platform’s architecture and primary SCRM capabilities.

2. Product Information Describe how your solution can be used to assess risks posed to the FBI by a product/entity’s supply chain, at all its tiers.

3. Product Information Please confirm whether your solution includes broad categorization of products, specific product SKUs, and traceability done to SCOMs and micro components.

4. Product Information What datasets are available in your solution and how does your platform model supply chain relationships across vendors, products, and components? Specifically, please identify any data assets that you have that are related to risks and vulnerabilities (i.e., product risks, CVE, CWE, foreign influence, etc.).

5. Product Information Please describe how data relationships are managed and validated as new data assets are added to the search model and functional user interface.

6. Product Information Describe how your solution can map the supply chain of a product (either all Tier suppliers or at least to Tier 3 suppliers)?

7. Product Information Describe how your solution can continuously monitor or track information related to a product/entity’s supply chain. How frequently is new information loaded, and how quickly can your solution provide an update to a user?

Version 1.2 Page 8

8. Product Information Describe all the data sources your solution can monitor for financial, operational, cyber or governance risk indicators.

9. Product Information Describe your solution’s ability to establish triggers and thresholds for specific risk factors, and transmit an alert to users, if changes in the supply chain of a product/entity occur.

Please describe how client-specific risk factors can be configured within the solution. Are there also pre-set risk factors? If so, how often are these factors updated?

10. Product Information Describe your solution’s capabilities to calculate a composite risk rating or score for a given product or entity, given various factors of its supply chain. Can the calculation algorithm for such a score be customized by a user?

11. User Experience Describe all the ways in which information from your product can be viewed and downloaded by an end-user. What integrated analytic or visualization tools are available to export artifacts? What customization options are available? For example, how does the system configure report exports, create source lists, and save queries for continuous monitoring? Are there other end-user facing configurable functions?

12. User Experience Is your platform operable or compatible with any other delivery configuration (e.g., a desktop application, mobile device application, etc.)?

13. User Experience How frequently would periodic maintenance and upgrades need to be performed on your solution? What actions could the FBI take to ensure the solution maximizes application availability and minimizes potential downtime?

14. User Experience Please describe how your system allows end users to access and update the same information at the same time.

15. User Experience Describe how client help and support are handled.

Additionally, please describe any built-in help features and/or reference materials assist in validating, implementing, and training to the usage of your solution in a production environment.

16. Security Describe how your system will safeguard both user and account information.

17. Security Describe the user authentication system used by your system (password, multi-factor authentication, etc.).

Version 1.2 Page 9

18. Security Please describe any native interface tools that your solution has (i.e., APIs, REST services) along with their corresponding data protection (i.e., data encryption at rest) for integration with other enterprise services.

19. Security Explain how searches or analyses conducted using your product are protected and not discoverable by other users of the system.

20. Security Describe where your system is hosted or can be hosted (i.e., on premises or cloud). Is this hosting location accredited by the U.S. government (e.g., FedRAMP)? What standards are employed to accredit and audit this hosting environment (e.g., NIST, ISO)? Can your system be air gapped and/or deployed on secret networks (e.g. SC2S)?

21. Security What back-up practices are used to protect data stored in your system from inadvertent deletion or corruption? How quickly can data be restored in the event of an incident?

22. Security Will your organization provide all information required by the FBI’s security components to adopt this accreditation and certify its use?

23. Product Enhancements Are there benefits that would be incurred from use of your proposed architecture, in terms of effectiveness or efficiency, but have not been otherwise stated?

24. Product Enhancements What optional features do you offer to work in conjunction with your core product which may benefit the effectiveness or efficiency of your solution?

25. General Information Describe the cost and licensing model used for your solution.

Submit a Rough Order of Magnitude (ROM) cost, in a dollar amount, to achieve requirements section of this RFI.

Associated assumption related to the ROM are welcomed.

DISCLAIMER and RESPONSES

THERE IS NO COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION AS A RESULT OF

THIS RFI. THIS IS BEING ISSUED SOLEY FOR INFORMATIONAL AND PLANNING PURPOSES AND

DOES NOT CONSTITUTE A SOLICTIATION. IN ACCORDANCE WITH FAR 15.201(e), RESPONSES

TO THIS NOTICE ARE NOT OFFERS AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO

FORM A BINDING CONTRACT. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES

Version 1.2 Page 10

NOT CONSTITUTE A SOLICITATION AND MUST NOT BE CONSTRUED AS A COMMITMENT BY

THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS

UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT.

ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS

STRICTLY VOLUNTARY.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE

1. All interested parties must submit capability packages in response to this notice.

2. Do submit succinct, thoughtful responses to the requirements/questions listed in this RFI.

3. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

4. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the FBI.

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit past performance information or general descriptions of corporate experience.

3. Do not submit requests to be considered for award or to be notified of a future solicitation.

4. Do not submit requests to be added to a mailing list or distribution list.

5. Do not submit questions or comments unrelated to this RFI.

6. Do not respond via telephone.

RFI SUBMITTAL INSTRUCTIONS

All submissions must be submitted electronically in Microsoft Word/Excel/PowerPoint or PDF format. All information should be UNCLASSIFIED material only. Submissions must not exceed twenty (20) one-sided 8 ½ x 11 pages. The pages must have one-inch margins and font size must be at least 12-point font.

All questions must be sent via E-mail no later than April 17th Noon Eastern Time and answers will be posted via SAM.gov by April 24th. The government reserves the right to not answer questions that may provide an unfair advantage. All submissions should be e-mailed no later than 3:00 PM Eastern Time, May 6th , 2026 to Contracting Specialists, Brandon James at bmjames@fbi.gov and Harriett Williams at hlwilliams.@fbi.gov. The E-mail subject must be labeled “RFI- Supply Chain Illumination.”

mailto:bmjames@fbi.gov mailto:hlwilliams.@fbi.gov

Version 1.2 Page 11

The cost of responding to the RFI must be exclusively borne by the organization submitting the information. No costs will be reimbursed by the government. The FBI makes no implied or in fact contract by issuing this RFI.

All clarifications, questions, and responses must be made via email. All questions regarding this RFI must be in writing. No phone calls will be accepted. Phone messages will not be returned.