RFI for Cybersecurity Supply Chain Risk Management (C- SCRM) Program

The Department of Agriculture's Assistant Secretary for Departmental Management is conducting a Request for Information (RFI) to develop a comprehensive Cybersecurity Supply Chain Risk Management (C-SCRM) Program through the Office of the Chief Information Officer's Cybersecurity and Privacy Operations Center. The RFI seeks to gather industry capabilities for establishing a program that ensures compliance with federal cybersecurity regulations, including Executive Orders 14028 and 13873, and NIST frameworks. Interested vendors must submit 10-page capability statements addressing four key areas: federal regulation compliance, C-SCRM capabilities, provenance tracking, and due diligence information management. Contractors will need to have at minimum a Public Trust Background Investigation and potentially work remotely. Responses are due by January 8, 2025, with the primary objective of conducting market research to inform future acquisition strategies.

This opportunity is designated as a Total Small Business set-aside, falling under the NAICS category 561499 (All Other Business Support Services) and PSC category DJ10 (IT and Telecom - Security and Compliance as a Service). While no specific award value is mentioned, the RFI indicates the government's intent to develop a robust cybersecurity supply chain risk management solution that can integrate automated processes, digital marker technology, and comprehensive information sharing capabilities. Contractors will be expected to demonstrate scalable solutions for tracking information and communication technology (ICT) products, strengthen supply chain security, and provide options for accessing, aggregating, storing, and sharing supply chain risk information. The RFI emphasizes that this is a market research effort only, with no contract award or payment intended for the submitted information.