SupplyChainIllumination QnA SCRM Response.xlsx

XLSX spreadsheet 16 KB Posted Apr 24, 2026

Attached to: Supply Chain Illumination RFI
Solicitation number: Not on record
Issued by: Department of Justice Federal Bureau of Investigation Headquarters Division

About this file

Written by GovTribe AI · Apr 24, 2026

This is a Questions and Answers document from the FBI addressing vendor inquiries regarding a Supply Chain Risk Management (SCRM) illumination platform procurement. The FBI seeks a SaaS-based solution to illuminate information and communication technology (ICT) products, software, and services through detailed supply chain visibility and risk assessment capabilities.

The solution must provide micro component traceability (minimum three layers back including smart chips and transistors), software bill of materials (SBOM) and hardware bill of materials (HBOM) generation, supply chain relationship mapping, and vendor/product risk profiling. Data sources should include technical vulnerability databases (NVD, CISA), blockchain, shipping records, and corporate ownership data with minimum 24-hour refresh rates and near real-time alerting. The platform must align with NIST 800-161 and FIPS 199 frameworks for risk scoring while supporting customization, operate on FedRAMP Moderate unclassified networks without ingesting FBI asset inventory into vendor-hosted environments, and prohibit storage of FBI-derived data outside government-controlled infrastructure. Initial deployment is limited to 15-20 users monitoring approximately 500 vendors with an unknown number of products on an unclassified network only. The FBI will not provide integrations with enterprise systems on day one but requires outputs in standard formats (Word, PDF, CSV). Tiered licensing based on users is preferred, and vendors must provide ongoing sustainment and operational support. FedRAMP High authorization is not required initially, though SaaS solutions must complete the Security Assessment and Authorization (SAA) process.

View the file

Other files

File	Type	Posted
SCRM Platform - Final.pdf	PDF	Mar 24, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1

Question #	Question	FBI Answer:
1	In order to achieve best value to the Government, consider solutions that are not currently FedRAMP High authorized. Can the FBI clarify whether alternative deployment models — such as government-controlled, on-premises, or enclave-based environments — may be considered where equivalent or greater security controls are demonstrated, including solutions operating at FedRAMP Moderate with a defined path toward FedRAMP High authorization?	Alternative deployment models are acceptable, provided the system is not hosted on or connected to the secret enclave or network. Acceptable deployment models can be FedRAMP moderate for use on unclassified networks
2	What deployment models are preferred (e.g., SaaS in GovCloud, hybrid, on-premises, or air-gapped environments such as SC2S)?	Preference for SaaS
3	Can the FBI clarify whether solutions are expected to operate without requiring ingestion of FBI asset inventory data into vendor-hosted environments?	Solutions are expected to operate without requiring ingestion of FBI asset inventory into vendor-hosted environments. However, solutions should have the ability to ingest asset inventory that may be available in the future
4	Are there restrictions on storing FBI-derived or enriched data outside of government-controlled infrastructure?	Yes
5	Is probabilistic or inferred relationship modeling acceptable where direct supplier data is not available?	The desire is to have datasets that are based on valid records. Where their are gaps in records - it must be clear that an inferred or probabilistic relationship is being estimated (and what the basis of that inference is).
6	Can the FBI clarify expectations for hardware microcomponent traceability, including required granularity and acceptable data sources?	At minimum traceability should go three layers back (Example: would want data on Company A, Company B who supplies Company A, and Company C who supplies company B) For products such as computers, component granularity should at least include the smart chips and transistors.
7	How should vendors address limitations in commercially available hardware component data when demonstrating traceability capabilities?	Clearly state limitations and respond with a negative if nothing is found
8	What update frequency is expected across different data types (e.g., cyber vulnerabilities, corporate ownership, trade/shipping data)?	For all data types near real-time is expected, but no more than 24 hours
9	What constitutes acceptable latency for alerting (e.g., real-time, near real-time, or periodic updates)?	Near real-time, at minimum once daily updates
10	What types of FBI systems should solutions be prepared to integrate with (e.g., procurement, asset management, workflow, tasking, communications and analytics platforms )?	None at this time, but outputs should be in commonly used file formats (word, PDF, csv, etc.)
11	Are there preferred API standards, data schemas, or interoperability requirements for integration?	The FBI is seeking the vendor's current approach in how integration, standards, interoperability, data schemas, and interfaces are managed as part of their base services as well as what options would require additional contract modifications or system change requests that could be added to the product baseline.
12	Are there required or preferred data sources (e.g., NVD, CISA, commercial datasets) that solutions should incorporate?	Preferred sources should include technical vulnerability data sources, blockchain, train/boat/car/shipping data sources etc.
13	Should risk scoring methodologies align with specific frameworks (e.g., NIST 800-161), or be fully customizable to mission needs?	Yes, methodologies must align with NIST 800-161 and FIPS 199. Preferance for customization capabilities
14	To ensure ROM pricing reflects realistic assumptions, can the FBI provide scope parameters such as anticipated user count, number of ICT assets or vendors to be monitored, and whether pricing should reflect an enterprise-wide deployment or an initial pilot/limited deployment scenario	15-20 users, limited deployment scenario. Estimated 500 vendors, products unknown
15	Can the FBI clarify its preferred acquisition and deployment model for the contemplated solution, including whether solutions are expected to be delivered as SaaS offerings, or government-hosted deployments? Additionally, would the FBI consider solutions deployed within FBI-controlled, contractor or government environments (e.g., on-premises or enclave-based deployments) that minimize external data exposure while meeting security requirements?	Saas Offering (Tag Contract Specialist)
16	Beyond illumination and data analytics, does the FBI anticipate requiring workflow automation, tasking, or case management capabilities as part of this solution — or are those functions expected to be handled by existing FBI enterprise system	No
17	Can the government please confirm what is meant by “integrate with FBI enterprise systems”? Would this focus on ingesting FBI data?	Integration with FBI enterprise systems is considered for long term implementation. This means that the tool and services should incorporate some standardization for interfacing, vendor processes for requirement decomposition and system integration, and ongoing system and configuration integration and configuration support as needed.
18	Does the FBI have a current inventory of ICT vendors and products that would serve as the starting point for illuminating the existing deployed estate? What format is that inventory in and what is the approximate scale — number of vendors and products — that the platform would need to process?	Yes for vendors, not for products
19	For the pre-procurement risk assessment, what does the typical workflow look like today? Who initiates the illumination request — the contracting officer, the SCRMU, or both? At what stage of the procurement process does a risk assessment need to be completed — before vendor selection, before contract award, or both?	SCRMU initiates the illumination request and completes the pre-procurement risk assessment before the purchase is complete
20	What is the FBI's required data refresh frequency for continuous monitoring? Specifically, for ownership and corporate structure changes, for prohibited entity list updates, and for cybersecurity vulnerability data — what latency is acceptable between a change occurring in the real world and it being surfaced in the platform?	Data refresh frequency is at minimum every 24 hours
21	When continuous monitoring detects a change in a vendor's risk profile, what action does the FBI expect the platform to enable — an alert triggering a manual review, an automated escalation to a contracting officer, or a documented finding that feeds into a broader risk register?	A system alert and email trigger to initiate a manual review
22	The RFI references integration with FBI enterprise systems and different network enclaves. Can the FBI confirm whether the initial deployment scope covers the unclassified network only, or whether the platform will be required to operate on classified networks including SC2S within the initial contract period?	Unclassified network only
23	Does the FBI have a preference for a fully hosted SaaS deployment on FedRAMP High GovCloud, an on-premise deployment, or a hybrid model?	SaaS deployment
24	Will the FBI consider sharing access to internal procurement or risk databases — even in a restricted or anonymized format — to improve the accuracy of risk calculations and reduce reliance on commercially available data sources alone? If so, what governance or data sharing agreements would govern that access?	No
25	Does the FBI see value in a solution where ICT vendors and their sub-tier suppliers can proactively submit and maintain their own supply chain data within the platform, in addition to data derived from third-party commercial sources? Would supplier-verified data carry more evidentiary weight in risk assessments and procurement decisions than commercially derived data alone?	Vendor supplied data is acceptable but will be validated. Supplier provided information could be treated as commerically available information for regulatory compliance if it is not derived from pubically available information.
26	Has the FBI considered or implemented contractual requirements that obligate prime vendors to maintain and update supply chain transparency data within a designated platform as a condition of contract award or renewal? If not, is this something the FBI would consider as part of the SCRM illumination program?	No response
27	When prime vendors have voluntarily disclosed their sub-tier suppliers in past procurement cycles, how accurate and complete has that disclosure typically been? Has the FBI found discrepancies between what prime vendors report about their supply chains and what independent data sources reveal?	No response
28	When the FBI has requested sub-tier supply chain disclosure from prime vendors beyond Tier 1, to what extent have those vendors been willing to provide that information? What has driven resistance when it has occurred — competitive sensitivity, lack of internal visibility into their own supply chains, contractual restrictions with their sub-suppliers, or other factors?	No response
29	In the FBI's experience, do prime ICT vendors typically have full visibility into their own sub-tier supply chains at Tier 2, Tier 3, and beyond? Or does the visibility problem exist not just for the FBI but for the primes themselves?	No response
30	Are there authoritative FBI source systems that the platform must integrate with on day one (e.g., procurement systems, asset inventory/CMDB, ERP, vulnerability management, identity management). Could you please list down all the systems that you expect our platform to connect with. What interface standards are available for each system (REST API, SOAP, flat file, message bus, etc.)?	No, no integrations at this time
31	Are there any restrictions on external connectivity to third-party data providers?	Commerically Available Information and Artifiicial Intelligence require additional governance levels for integration with FBI operations.
32	Are there expectations on how composite risk scoring is to be calculated and governed? Are there existing weighting models or risk taxonomies? Should analysts be able to configure scoring rules? Is there a requirement for explainability/auditability of scores?	Open to weighting models and risk taxonomies that fall within the FIPS 199 and NIST 800 161 frameworks.
33	What constitutes a minimum viable implementation versus future phases? Which requirements are mandatory at initial deployment (e.g., Tier 3 mapping, SBOM generation, automated alerts, shipping records, APIs) and which can be delivered in later increments?	Tier 3 mapping, SBOM generation, HBOM generation, automated alerts, shipping records,
34	Please provide what tool the FBI is using currently to identify, monitor, or manage the below requirements to ensure proper configuration, integration, and replication for below:

• Continuous Monitoring/current alert and/or monitoring system:

• Due Diligence:

• Supply Chain:

• Structured product/vendor registries:

• Supply chain relationship mapping:

• Supply chain Bill of Materials breakdowns:

• Micro component traceability functionality:

• Shipping/transport record:	No response
	35	To better understand delivery expectations, does the FBI anticipate that all primary risk datasets are to be natively provided by the solution, or should the solution be designed to ingest and normalize FBI‑furnished or government‑owned datasets as well?	Yes, however FBI can provide company name and product
	36	From a governance perspective, does the FBI envision centrally managed risk scoring models across the enterprise, or should the platform support mission‑ or program‑specific scoring models managed by different user groups?	There is one enterprise risk scoring model for supply chain that is centrally managed by the SCRMU
	37	For lifecycle planning, does the FBI anticipate government personnel performing routine configuration and content updates, or should respondents assume ongoing vendor‑led sustainment and operational support?	FBI will require ongoing vendor-led sustainment and operational support
	38	For ROM development, should respondents assume a single enterprise‑wide license, or is the FBI considering tiered licensing based on users, products, or mission areas?	Tier licensing based on users
	39	To bound accreditation effort, should respondents assume reuse of existing FedRAMP High authorizations, or is the FBI anticipating FBI‑specific ATO processes as part of the implementation?	Yes, and SaaS solutions will still need to complete the SAA process
	40	How many users are anticipated as full system users, and how many for consumption of dashboards/notifications?	15-20
	41	What is the volume of data for Products and Suppliers which will drive level of effort in Cost and Licensing models.	Suppliers around 500, products unknown
	42	What is the volume of data expected for continuous monitoring, such as increases in products and suppliers?	Suppliers around 500, products unknown
	43
	44
	45
	46
	47
	48
	49
	50

File details come from the government source that posted it. Updated Apr 24, 2026.