CSO SCRM (SAM.gov) - Industry Day Q&A - Sep26.xlsx
XLSX spreadsheet 24 KB Posted
- Solicitation number
- W519TC-26-R-SCRM
About this file
This file is an Industry Day Q&A document from a September 2, 2026 webinar addressing vendor questions regarding the Army's Call for Solutions (CFS) for an Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Monitoring Tool (Solicitation W519TC-26-R-SCRM). The Government clarified key requirements including that offerors are responsible for acquiring, ingesting, and analyzing Software Bills of Materials (SBOMs) as part of the proposed platform's automated risk assessment capabilities under Factor 3. The platform must conduct continuous risk and vulnerability monitoring on all software and SaaS SKUs in the Government-supplied catalogs regardless of prior Authorization to Operate (ATO) or FedRAMP status, with offerors proposing their standard automated monitoring cadence and data refresh methodology. The tool is expected to analyze SBOM risk for all supported versions of software products included in the catalogs and must automate technical SBOM and Hardware Bill of Materials (HBOM) analysis to identify and flag Known Vulnerabilities (CVEs), while presenting complex findings through an intuitive dashboard for Government users and supporting workflow handoffs for specialized deep-dive reviews under Factor 4.
The Government denied a request for a one-week extension to the Solution Brief submission deadline of September 9, 2026 at 1200 Eastern Standard Time, emphasizing it is the vendor's sole responsibility to ensure timely receipt to the Contracting Officer at Corene.n.feddersen.civ@army.mil. A specific ATO authorization level is not a rigid prerequisite for Phase 1 evaluation, though the Government will assess current authorization status as part of the overall technical evaluation. The Government indicated that specific SCRM risk flags and taxonomy requirements are evolving policy matters and expressed interest in vendor tool capabilities rather than providing a definitive publicly available link to current taxonomies at this stage.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Industry Day (9-2)
| CFS / ICT-SCRM / INDUSTRY DAY Q&A (09/02/2026 @ 10am EST) | ||
| Question # | Vendor Question | USG Response |
| 1 | Does the government supply SBOMs from Vendors to the effort, or is that scope of effort the responsibility of this effort? | The responsibility for acquiring and analyzing the Software Bill of Materials (SBOMs) for monitored products is part of the scope of this effort. Under Factor 3, the proposed platform is expected to have the capability to continuously monitor for SBOMs as part of its automated risk assessment. Offerors should describe their methodology for obtaining, ingesting, or generating SBOMs for the software products under review |
| 2 | What specific SCRM risk flags and taxonomy does this solution need to meet, and can you share a publicly available link to those update SCRM risk flags and taxonomies? I know the categories have been updated in the past. | The policy/requirements are always evolving. We're interested in what your tool can do. |
| 3 | Are SBOMs analysis for SaaS vendors with Government ATOs (IL# or FedRAMP) in the catalogue required as part of this effort, and if so at what cadence? | Yes, continuous risk and vulnerability monitoring applies to all software/SaaS SKUs submitted in the catalog regardless of prior ATO/FedRAMP status. Offerors should propose their standard automated monitoring cadence and data refresh methodology under Factor 3 |
| 4 | Will you consider offering an ATO if selected if you do not already have one in place? | A specific authorization level is not a rigid prerequisite for the Phase 1 evaluation. The Government will assess the offeror's current authorization status as part of the overall technical evaluation. |
| 5 | Is SBOM risk analysis representation for the most recent vendor release in the catalogue, or or every supported version of the vendors software? Does the government provide this information in an automated fashion? | The platform is responsible for conducting SBOM risk analysis for all software versions that are included in the product catalogs furnished by the Government for monitoring. If a catalog includes multiple supported versions of a single software product, the tool is expected to be capable of analyzing each version. |
| 6 | Given the shortened timeline with the long holiday weekend, would a one week extension for submissions be considered? | No |
| 7 | Is BOM deep dive analysis the role of this contractor, or is there Government staff expected to staff this. function and role? | The software platform must automate the technical SBOM analysis and risk correlation. Under Factor 4, the tool is evaluated on its ability to present these complex findings in an intuitive, easily understood dashboard for Government users, while supporting workflow handoffs for specialized Government deep-dive reviews. |
| 8 | What is the emphasis on cyber risk as part of your SCRM workflow? | The tool must be able to monitor for and analyze Software/Hardware Bills of Materials (SBOM/HBOM) to identify and flag Known Vulnerabilities (CVEs). |
2. Secure Architecture (Factor 1)
File details come from the government source that posted it. Updated .