CSO SCRM (SAM.gov) - Q&A Workbook_Sep26.xlsx
XLSX spreadsheet 32 KB Posted
- Solicitation number
- W519TC-26-R-SCRM
About this file
This is a Question and Answer (Q&A) workbook documenting 49 vendor questions and Government responses regarding a Call for Solutions (CFS) for an Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Monitoring Tool, issued by the Department of the Army's Product Lead Digital Market under Capability Program Executive Enterprise Software & Service. The Solution Brief submission deadline is 09 SEP 2026 at 1200 EST, with no extension possible due to urgent deployment timelines. Submissions must include a seven-page Technical White Paper and a recorded video demonstration (not exceeding 15 minutes, delivered as an unlisted YouTube link) using vendor-provided mock data with on-screen chapter markers identifying five evaluation factors. Proprietary information marked with standard legends on cover pages and video opening frames will receive FOIA Exemption 4 protection during evaluation and post-award.
The Q&A addresses critical technical and operational requirements: the platform must ingest and screen catalogs of 10,000+ SKUs from approximately 1,000 unique vendors monitored during the base year, with anticipated Government users limited initially to Product Lead Digital Market and select CIO personnel; the software must natively integrate into a unified platform (not fragmented tools) to automatically generate risk scores, compliance flags, and alerts for FOCI, NDAA, TAA, and CVE compliance using vendor-provided commercial threat intelligence and corporate ownership data; vendors must submit Software Bills of Materials (SBOM) in CycloneDX or SPDX format and provide dual CVE monitoring for both the platform and ingested hardware/software catalogs; the platform must demonstrate flexible ingestion of CSV/XML catalogs with automated normalization, dynamic alert generation, and configurable risk-scoring methodologies; Federal hosting authorization (IL2/IL4/IL5 or FedRAMP) and inheritance from underlying authorized cloud environments are acceptable for Phase 1; and teaming arrangements with subcontractors for specific capability areas are permitted provided all functions are seamlessly integrated into the prime vendor's unified platform. The Government has not mandated specific IT e-Mart API specifications, SPRS integration methods, or upstream Government system architectures at Phase 1; offerors must propose their own mature technical solutions and demonstrate flexibility to adapt to evolving Government requirements in Phase 2.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CFS Q&A (9-1)
| CFS / ICT-SCRM / Q&A on Call for Solutions (SEP 2026) | |||||
| Question # | Reference Category | Section | Vendor Question | USG RESPONSE | |
| 1 | Question – Video Production Timeline | ||||
| Section 7.2 requires Part B of the Phase 1 submission to be a recorded video demonstration of the live software platform, delivered as an unlisted YouTube link, not exceeding 15 minutes, using vendor-provided mock data, and including on-screen chapter markers or burn-in text identifying which Evaluation Factor is being demonstrated. Producing a demonstration that meets these constraints across all five Evaluation Factors within a single, coherent recording requires meaningful production lead time (data preparation, environment setup, recording, and editing). Given the current Solution Brief suspense of 09 SEP 2026, 1200 EST, would the Government consider an extension to the overall Phase 1 submission deadline, or to the Part B video demonstration specifically, to allow offerors sufficient time to produce a fully compliant demonstration? | No. Due to urgent deployment timelines, the Government cannot extend the Phase 1 submission deadline. | ||||
| 2 | Question – Government Use and Protection of the Video Demonstration | ||||
| Will the Government's use of the Part B video demonstration be limited strictly to evaluation of this Call for Solution, or may it be shared with other Government activities, agencies, or programs outside this specific procurement? What steps, if any, will the Government take to protect the video from redistribution to other parties or activities without the submitting vendor's express permission, both during the evaluation period and after Phase 1 outcomes are determined? | The Government will utilize the videos solely for evaluating submissions for this Call for Solutions. Access to the video links will be restricted to authorized Government evaluation personnel. | ||||
| 3 | Question – Marking and Protection of Proprietary Information | ||||
| The CFS does not specify a method for marking proprietary or trade secret material within the Technical White Paper or video demonstration. Please confirm whether the Government will accept and honor a standard proprietary/confidential commercial information legend applied to the cover page of the white paper and the opening frame of the video, and whether such marked material will be afforded protection under FOIA Exemption 4 in the event of a records request, both during the evaluation period and following any award decision. | Confirmed. The Government accepts standard proprietary legends on the white paper cover page and video opening frame. Qualifying proprietary, commercial, or trade secret information will be afforded protection under FOIA Exemption 4 and applicable statutory authorities both during the evaluation period and post-award. Offerors should ensure specific proprietary portions are clearly identified. | ||||
| 4 | Question – Teaming Arrangement Documentation and Page Limit Application | ||||
| For a Solution Brief submitted jointly by two companies under a Contractor Teaming Arrangement, what documentation, if any, must accompany the Phase 1 submission to establish the teaming relationship? Additionally, does the seven (7) page limit specified in Section 7.1 apply to the combined submission as a whole, or is any additional allowance made for a jointly-submitted Solution Brief? | Offerors must describe the roles and responsibilities of each team member in their submission. The seven-page limit applies to the entire technical white paper, inclusive of any teaming information. | ||||
| 5 | Question – Anticipated User Community and Scope | ||||
| For purposes of developing an accurate Rough Order of Magnitude and a right-sized technical architecture, can the Government provide any available information on the anticipated user community — for example, whether initial deployment and access will be limited to Product Lead Digital Market personnel, or whether broader usage across other Army or DoD procurement activities is anticipated during the period of performance? | For ROM-planning purposes, offerors should base their estimates on the Factor 2 requirement of ingesting and screening catalogs of 10,000+ SKUs. We anticipate approximately 1,000 unique vendors will be monitored during the base year. The Government has not established a fixed estimate for API transaction volumes; offerors should state any standard rate limits or usage tiers associated with their proposed licensing model. Direct access to the tool will be limited to PL DM and select CIO personnel, while risk data will be shared more broadly with registered marketplace users. | ||||
| 6 | Catalog schema and identifiers. For the CSV/XML product catalogs referenced under Factor 2, what identifier fields will be present for each line item (for example, manufacturer or publisher name, manufacturer or commercial part number, CAGE code, NSN/NIIN, and country of origin)? Will listings within the IT e-Mart / Digital Market carry these structured fields, or will records consist of a vendor catalog number and free-text description only? | Currently, the Government is receiving some of the following catalog schema and identifiers: Manufactor part number, Manufactor name, vendor part number, and UNSPSC. However, the Government is able to update he catalog schema and identifiers to work with the solution. | |||
| 7 | Industry Day. We looked at the industry website but do not see any industry day listing for this opportunity. Could you please provide the industry day link for the Offerors to sign up? | Please refer to the following link for Industry Day details: https://www.army.mil/enterprise#org-events | |||
| 8 | Video demonstration of e-Mart integration. Factor 1 requests a demonstration of risk scores and compliance flags being pushed "into the Army's Digital Market / IT e-Mart," while Section 7.2 states that no Government data or system access will be provided. Will a demonstrated API export to a representative or mock endpoint satisfy this requirement for the Phase 1 video? | Yes a mock API setup will be allowed. | |||
| 9 | IT e-Mart API and integration requirements. Can the Government provide the IT e-Mart / Digital Market API specification, data schema, or Secure API Gateway integration requirements at this stage, or will those materials be furnished only to a down-selected or awarded vendor? | The Government is not providing an IT e-Mart API specification at this stage. Offerors must present their own mature API capabilities, schemas, and technical specifications under Factor 1. The Government requires a flexible, platform-agnostic solution that can seamlessly adapt to evolving Government architectures upon Phase 2 down-select. | |||
| 10 | Own-platform SBOM format. For the Software Bill of Materials that a vendor provides for its own platform under Factor 1, does the Government have a preferred format (for example, CycloneDX or SPDX) and a preferred delivery mechanism? | The Government is open to any Software Bill of Materials (SBOM) submissions formatted in either CycloneDX (JSON/XML) or SPDX (JSON/tag-value) adhering to standard NTIA minimum elements. | |||
| 11 | Page-limit & graphics. Are tables, diagrams, and screenshots counted within the seven-page limit for the Technical White Paper, and can text contained within graphics be less than 11-point font and in any font as long as it's legible? | Yes page limit includes graphics, tables, graphics, and screenshots. Test and labels contained within graphics are not subject to the 11-point font restriction, but must be clearly legible. | |||
| 12 | ROM planning assumptions. To inform the Rough Order Magnitude, can the Government provide the anticipated number of Government user seats and the estimated catalog volume (number of vendors and line items) to be monitored under the resulting effort? | Please see the response to question #5. | |||
| 13 | Anti-counterfeit scope. For the anti-counterfeit element of Factor 2, does the Government consider automated surfacing of counterfeit and nonconforming-part indicators from Government sources such as GIDEP to be sufficient, or is dedicated forensic counterfeit testing expected within the core software capability? | The software platform is expected to provide automated surfacing, alerting, and risk scoring of counterfeit and nonconforming-part indicators from sources like GIDEP and industry feeds. Physical or forensic counterfeit testing is not required within the core software capability | |||
| 14 | Hosting & Authorization (Factor 1) | For Phase 1 evaluation, is a written commitment/roadmap to a specific Impact Level (IL4/IL5) or FedRAMP boundary sufficient, or must the offeror's exact proposed tenant already hold a signed, named authorization letter at the time of Solution Brief submission? | A specific authorization level is not a rigid prerequisite for the Phase 1 evaluation. The Government will assess the offeror's current authorization status as part of the overall technical evaluation. | ||
| 15 | Hosting & Authorization (Factor 1) | Does "current DoW/Federal hosting authorization status" require the authorization to cover the specific named software product/tenant proposed, or is inheritance from a broader authorized cloud environment/boundary acceptable at this phase? | For Phase 1, inheritance from an underlying authorized cloud environment (e.g., IaaS/PaaS) is acceptable. Offerors must clearly delineate between the inherited infrastructure controls (e.g., AWS/Azure IL5 boundary) and the authorization status of the specific software application/SaaS layer proposed, including any roadmap to achieve full platform authorization. | ||
| 16 | SBOM / HBOM / CVE Scope (Factors 1 & 3) | What SBOM format(s) will the Government accept (SPDX, CycloneDX, SWID), and is a specific refresh cadence mandated, or is the offeror free to propose one? | The Government accepts machine-readable SBOMs in CycloneDX or SPDX formats. Offerors are free to propose their standard SBOM update cadence (e.g., per build or release) within their Factor 1 submission. | ||
| 17 | SBOM / HBOM / CVE Scope (Factors 1 & 3) | Is component-level CVE monitoring expected only for the vendor's own software platform (the Factor 1 SBOM requirement), or also for every hardware/software SKU submitted through the catalog (Factor 3)? | CVE monitoring is a dual requirement. | ||
| 18 | SBOM / HBOM / CVE Scope (Factors 1 & 3) | What level of hardware bill-of-materials decomposition is expected (board-level assemblies versus individual semiconductor components)? | At a minimum for initial ingestion, offerors must provide Level 1 decomposition (major assemblies, populated boards/PCBAs, and primary controller/active semiconductor components). Offerors will be evaluated on their capability to recursively illuminate sub-tier semiconductor components, firmware origins, and raw material origins as data availability matures. | ||
| 19 | Catalog Ingestion (Factor 2) | Section 7.3 references catalogs "in standard CSV or XML formats" — will the Government accept ingestion via an automated CSV/XML-to-CIF or cXML normalization step as part of the pipeline, or must the platform natively parse raw CSV/XML without any conversion step? | Yes, automated normalization is acceptable. The Government does not mandate raw parsing without conversion, provided the transformation pipeline operates automatically and the normalization framework is flexible and easily manageable as data formats change over time. | ||
| 20 | Catalog Ingestion (Factor 2) | Is there a published data dictionary or API specification for the Digital Market IT e-Mart that offerors should design their outbound payload against, or should offerors propose their own schema for Government review in Phase 2? | Please see the response to Question 9. | ||
| 21 | Restricted-Source Verification | Does the Government expect an automated, system-to-system feed from SPRS (sprs.csd.disa.mil) into the offeror's platform, or is a Government-provided periodic data extract or manual verification workflow an acceptable substitute, given SPRS's typical PIV-gated access model? | The Government has not mandated a specific integration method for SPRS at this phase. Offerors are encouraged to propose their standard approach for ingesting external Government risk data—whether via automated feeds, batch ingestion, or structured data import—and highlight how their platform accommodates CAC/PII-gated data sources. | ||
| 22 | Gate 3 — Services Boundary | How much initial configuration, tenant provisioning, or catalog-mapping services can be included without a submission being read as "services-heavy" under the Gate 3 prohibition on services-only models? Is there a proportionality test the evaluation panel applies? | One-time configuration, tenant provisioning, and initial catalog mapping necessary to operationalize the software are acceptable. The Gate 3 restriction prohibits solutions requiring ongoing manual analyst intervention, bespoke consulting, or non-automated screening workflows to deliver the core requirements. | ||
| 23 | Teaming / Multiple Awards | Given the Government "reserves the right to make more than one award," is a prime offeror permitted to name subcontractors for specific capability areas (e.g., a dedicated SBOM/HBOM analytics partner) rather than claiming single-vendor coverage of all five evaluation factors? | Yes, prime offerors may include subcontractors for specific capability areas. However, all partner capabilities must be seamlessly integrated into a unified software platform delivered and supported by the prime offeror. | ||
| 24 | Video Demonstration Mock Data (Gate 5 / Section 7.2) | May the mock catalog data used in the video demonstration include fictional entities designed to resemble (without naming) real NDAA 889/1260h-listed companies for realism, or should the demonstration avoid any such resemblance even in fictionalized form? | Yes, that is acceptable | ||
| 25 | What minimum DoD impact level, FedRAMP status, or other hosting authorization must the platform possess at Phase 2 award and at production deployment, and what data classification or CUI categories will the selected platform process? | Please see the response for question #14. | |||
| 26 | Will the Government provide interface-control documentation for Digital Market/IT e-Mart, including required telemetry schemas, authentication protocols, secure API gateway constraints, push-versus-pull patterns, transaction volumes, and latency expectations? | Please see the response for question #9. | |||
| 27 | For ROM and licensing purposes, what are the anticipated numbers of Government users, catalogs, SKUs, prime contractors, sub-tier entities, annual catalog ingestions, monitored alerts, and API transactions during the base year? | Please see the response for question #5. | |||
| 28 | Which Government-maintained data sources or restricted feeds will be made available to the contractor, and which regulatory, corporate-ownership, product-provenance, vulnerability, and enforcement datasets must the contractor independently license and furnish? | Offerors are expected to provide and license all commercial threat intelligence, corporate ownership (FOCI/UBO), and supply chain risk data feeds necessary to deliver their baseline software solution. | |||
| 29 | What are the target dates for pilot availability and production deployment, and what measurable acceptance criteria will govern catalog-ingestion accuracy, OEM identification, regulatory flagging, alert latency, availability, and completion of security authorization activities? | For the Phase 1 Solution Brief, offerors should outline their standard commercial onboarding timelines, typical production deployment lead times, and standard commercial performance metrics / SLAs under Factor 1. | |||
| 30 | CFS - Pg.5 | Section 7.3, Factor 1 | What is the minimum acceptable hosting and security authorization level for the proposed platform during Phase 1 and for the anticipated production environment, such as IL2, IL4, IL5, FedRAMP Moderate, FedRAMP High, or another equivalent? | Please see the response for question #14. | |
| 31 | CFS - Pg. 6 | Section 7.3, Factor 2, 3, 4 | Should the video demonstrate alerts being generated dynamically during the recording, or may pre-generated alerts be used to demonstrate workflow and case-management functionality? | Offerors are expected to demonstrate both capabilities within their submission video. To satisfy the evaluation criteria under Factors 2 and 3, the video should demonstrate dynamic, automated alert generation (e.g., automated triggering upon data ingestion or continuous monitoring event). To satisfy Factor 4, offerors should also demonstrate case-management workflows, dashboard navigation, and alert triage using pre-populated or generated alerts to show end-to-end user experience. | |
| 32 | CFS - Pg. 8 | Section 8.1 | Will the Government accept a solution that integrates multiple COTS products and intelligence sources through a unified platform, or must all capabilities be provided natively within a single software product? | The Government requires a cohesive, user-operable software product. Solutions that rely on integrating multiple separate commercial software applications via custom professional services or that require Government users to navigate fragmented tools will not be considered responsive. | |
| 33 | CFS - Pg. 2 | Section 1.1 | Has the Government previously piloted, evaluated, or deployed any ICT-SCRM illumination or supply-chain monitoring solution? | No, PL Digital Markets has not piloted any tools to date. | |
| 34 | CFS - Pg. 5 | Section 7.2 | If an offeror's security policies prohibit the use of YouTube, will the Government accept an alternative secure streaming solution? Such as a submission of a video file through email or flash drive that contains the demo dropped off to the contracting office? | No, alternative delivery formats, file transfers, or physcial media (such as flash drives) will not be accepted. All offerors must submit their recorded demonstrations as unlisted YouTube links as specified in Section 7.2 | |
| 35 | CFS - Pg. 3-4 | Section 5.1 | It is noted that the Government will host a virtual Industry Day to provide a detailed overview of the ICT SCRM Monitoring Tool requirement and answer questions from potential offerors. However there are no noted details at the provided link. Will the Government please confirm if a virtual day will occur and when that event will be held? | Please refer to the following link for Industry Day details: https://www.army.mil/enterprise#org-events | |
| 36 | CFS - Pg.1 | Solution Briefs Due Date/Time (Suspense) | Based on the unique and complex requirements, will the Government consider a 2 week extension to allow bidders more time to finalize Phase 1 submissions? | No. Due to the current deployment timelines, the government cannot extend the Phase 1 submission deadline. | |
| 37 | General | General | Given the requirements outlined in the RFI and the Government's need for a COTS tool, did the Government consider leveraging the OUSD SCRIPTS BPA for this call for solutions and requirements ask? | The Government conducted thorough market research, including review of existing enterprise vehicles. This Call for Solutions was selected as the appropriate acquisition method to openly compete and evaluate solutions against the specific ICT-SCRM technical factors | |
| 38 | CFS - Pg. 2-3 | Section 1.2 and 2.0 | Please identify the contract vehicles, procurement channels, product catalogs, and Army organizations included in the initial operating scope. Is the initial implementation limited to PL Digital Market/IT e-Mart, or must it support additional Army-wide procurement channels and future contract vehicles? | Initial implementation is limited to scope of IT eMart. | |
| 39 | CFS - Pg. 2 and 6 | Section 1.2 and Factor 2 | Please provide estimated volumes for products/SKUs, prime contractors, sub-tier suppliers, catalog updates, API transactions, and Government users. Does “10,000+ SKU” represent the total expected catalog size, a single ingestion event, or a minimum performance threshold? | Please see the response for question #5. | |
| 40 | CFS / Army ICT SCRM Strategy Pg. 5-6 | Factors 1-2 | What Government systems will provide catalog, vendor, contract, task-order, waiver, SONA, and transaction data? Please identify expected formats, interfaces, refresh frequencies, and known data-quality limitations. | Specific upstream Government systems and interface definitions are not mandated for Phase 1. Offerors shall propose their standard technical solution, data formats, and ingestion workflows. The proposed platform must be flexible and capable of ingesting and normalizing varied data formats and schemas across evolving Government sources | |
| 41 | CFS - Pg. 6-7 | Factors 2-3 | Will the Government provide access to Government-owned risk intelligence, restricted-source lists, threat data, or commercial data subscriptions, or should the selected vendor provide and price all required external data sources? | Offerors must provide and price all necessary commercial risk intelligence in their ROM. The proposed tool must be inherently flexible and capable of rapidly ingesting and adapting to changing Government policies, custom restricted-entity lists, and emerging regulatory requirements | |
| 42 | CFS - Pg. 6-7 | Factor 4 | Does the Government have an established risk-scoring methodology and thresholds for red, yellow, and green results, alert severity, escalation, and procurement disposition, or should offerors propose a configurable methodology? | Offerors should propose their standard risk-scoring methodology and alert thresholds. Solutions will be evaluated under Factor 4 on their platform configurability and ease of customizing risk models, severity weights, and escalation workflows to meet specific Government mission requirements. | |
| 43 | Enhanced Section 806 Procedures Memorandum; Pg. 5-8 | N/A | Is the solution expected to ingest and operationalize Section 806 determinations, class determinations, exceptions, annual reviews, and related restrictions, or only provide risk information supporting those Government-led processes? If included, what access, dissemination, and need-to-know controls apply? | The tool is expected to provide risk information and automated telemetry supporting Government-led risk management and acquisition decisions, rather than managing statutory Section 806 legal determinations. | |
| 44 | CFS - Pg 9 | Section 8.2.4/Factors 4 | What events or conditions are expected to trigger reassessment, alert escalation, investigation, or procurement action? Are offerors expected to propose these workflows, or does the Government have predefined operating procedures? | The offeror may propose workflows. | |
| 45 | CFS - Pg. 8 | Section 8.2.2/Factor 2 | Does the Government maintain an existing approved ICT product catalog and supplier inventory that will be provided for solution onboarding, or is the proposed solution expected to establish and maintain these records as part of implementation? | The Government will provide a baseline of approved catalogs and suppliers for initial onboarding. However, the platform is expected to establish and maintain records on an ongoing basis by automatically ingesting, normalizing, and vetting raw contractor catalogs and newly submitted products | |
| 46 | Appendix A_DoD Memo_ENHANCED_SECTION_806_PROCEDURES_FOR_SCRM_ISO_DOD_TRUSTED_SYSTEMS_AND_NETWORKS; Pg. 5-7 | Sections 3.e - 3.j | Will the Government provide access to Section 806 class determinations, supplier restriction lists, exception decisions, and related adjudications in a consumable format (e.g., API, structured data feed, or managed repository) for integration into the proposed ICT-SCRM platform? | The primary scope of the platform is to provide automated illumination, risk telemetry, and compliance screening (e.g., FOCI, NDAA, TAA, CVEs) to support Government-led evaluation and procurement decisions. The tool is not required to serve as the authoritative system of record for managing formal statutory Section 806 exclusions or class determinations. However, offerors with existing capabilities to ingest custom Government watchlists or apply role-based access controls (RBAC) may highlight those features under Factors 1 and 4 | |
| 47 | Appendix A_Signed Army Information and Communication Technology Supply Chain Risk Management Strategy Final / Call for Solutions; Pg. 2 (Strategic Vision) / Pg. 5-6 (Factor 1) | Strategic Vision and Factor 1 | The Army ICT-SCRM Strategy identifies reducing friction in acquisitions and shortening Authority to Connect (ATC) timelines as a key objective. Is the proposed solution expected to integrate with or generate outputs supporting ATC, RMF, cybersecurity authorization, or product-vetting activities, and if so, what artifacts, interfaces, or data formats are required? | Please see the response for question #14. | |
| 48 | CFS | N/A | Please provide estimated number of users by role that are expected to access the solution, including acquisition personnel, contracting officers, SCRM analysts, cyber security personnel, administrators, and reporting users. Please identify any anticipated growth in user populations over the period of performance and whether external organizations will require access | Please see the response for question #5. | |
| 49 | CFS - Pg 8 | Section 8.1 | Can the Government provide an estimated number of systems, interfaces, data feeds, and external sources that the ICT-SCRM solution will be expected to integrate with during Phase 1 and full operational deployment? | Please see the response for question #9. |
File details come from the government source that posted it. Updated .