Software Supply Chain Security Solution
Open Solicitation Posted
- Solicitation number
- CORHQ-26-R-0394
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 513210 Software Publishers
- Place of performance
- Arlington, Virginia 22226, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The Federal Deposit Insurance Corporation seeks a Software Supply Chain Security Solution providing hardened, compliant container images with continuous vulnerability management and enterprise-grade support, with proposals due October 16, 2026. This is a full and open, single-award, firm-fixed-price procurement with no set-asides.
Place of performance is Arlington, Virginia. The initial performance period runs January 6, 2027 through January 5, 2028, with four optional one-year extension periods through January 5, 2032.
Mandatory requirements include remediation of container images to comply with FedRAMP Moderate, NIST 800-190, DISA STIG/CIS benchmarks, and DoD IL5/IL6 standards; cryptographically signed Software Bills of Materials; vulnerability remediation service level agreements (critical vulnerabilities within 7 days, high within 14 days, medium within 30 days, zero-day within 48 hours); daily package updates with automated rebuilds within 24 hours of upstream changes; support for AMD64, Intel x86-64, and ARM64 architectures; enterprise management portal with Active Directory and Azure Entra ID integration; and integration with JFROG, GitHub Enterprise Server, CrowdStrike, Trivy, and Splunk. The contractor must provide a Technical Consultant for JFROG pipeline integration and a Security Control Specialist to support NIST SP 800-53 compliance documentation and security authorization.
The contract covers 50 licensed container images across the base year and option periods. Help desk support is required 7 a.m.–7 p.m. Eastern Time, Monday–Friday, with response times ranging from 30 minutes for production-down issues to four business hours for limited-impact issues.
Offerors must submit five proposal volumes: Technical Approach (10-page maximum), Past Performance, Pre-Award Supply Chain Risk Management information, pricing via Excel template, and Additional Information. Questions are due October 2, 2026. Amendment 2, posted October 14, provided questions and answers with minor solicitation updates. The NAICS code is 513210, Software Publishers; PSC is 7A21.
Notice text
3 versions
Update #3 · Latest ·
October 14, 2026: Amendment 2 has been posted! The purpose of his Amendment is to provide Questions and Answers regarding the solicitation and to update the solicitation based on the questions and answers. The updates are minor in nature. Please review this Amendment. If you already submitted a proposal and wish to submit a revise proposal please do so before the RFP due date at 1 p.m. Friday, October 16, 2026. If you already submitted your proposal, please make sure it is compliant with the RFP.
October 8, 2026: Amendment 1 has been posted! The purpose of this Amendment is to extend the RFP due date to 1 p.m. Friday, October 16, 2026 to allow additional time for questions and answers reguarding the solicitation to be posted. That Amendment should be posted no later than Wednesday, October 14, 2026.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The Federal Deposit Insurance Corporation invites you to submit a proposal for the Software Supply Chain Security Solution. The Section B Price Schedule is within the attached RFP, but we require all offerors to complete the Software Supply Chain Container Excel Worksheet file (separate attachment to this contract opportunity). Please follow ALL instructions when completing the workbook. The RFP is non-transferable, unless approved in advance by the Contracting Officer. Please refer to the RFP package for all the requirements of this acquisition.
Offerors are also required to complete the Pre-Award Supply Chain Risk Management spreadsheet attachment in accordance with the solicitation requirements.
Please be sure to clearly indicate on the proposal response all contact information (i.e. account representative name, email addresses and phone numbers). Offerors shall pay particular attention to Section 7.3.1-06 “Identification and Delivery of Proposals-March 2009” of the RFP for specific proposal submission instructions.
Any questions regarding the solicitation shall be submitted to Hamilton Jackson at hamjackson@fdic.gov no later than 12:00 p.m. (noon) Friday, October 2, 2026.
To be considered for this opportunity, offerors shall provide all information required in the RFP, by 1 p.m. Friday, October 9, 2026.
Any missing volumes or required information in the proposal submission may be considered non-responsive.
Update #2 ·
October 8, 2026: Amendment 1 has been posted! The purpose of this Amendment is to extend the RFP due date to 1 p.m. Friday, October 16, 2026 to allow additional time for questions and answers reguarding the solicitation to be posted. That Amendment should be posted no later than Wednesday, October 14, 2026.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The Federal Deposit Insurance Corporation invites you to submit a proposal for the Software Supply Chain Security Solution. The Section B Price Schedule is within the attached RFP, but we require all offerors to complete the Software Supply Chain Container Excel Worksheet file (separate attachment to this contract opportunity). Please follow ALL instructions when completing the workbook. The RFP is non-transferable, unless approved in advance by the Contracting Officer. Please refer to the RFP package for all the requirements of this acquisition.
Offerors are also required to complete the Pre-Award Supply Chain Risk Management spreadsheet attachment in accordance with the solicitation requirements.
Please be sure to clearly indicate on the proposal response all contact information (i.e. account representative name, email addresses and phone numbers). Offerors shall pay particular attention to Section 7.3.1-06 “Identification and Delivery of Proposals-March 2009” of the RFP for specific proposal submission instructions.
Any questions regarding the solicitation shall be submitted to Hamilton Jackson at hamjackson@fdic.gov no later than 12:00 p.m. (noon) Friday, October 2, 2026.
To be considered for this opportunity, offerors shall provide all information required in the RFP, by 1 p.m. Friday, October 9, 2026.
Any missing volumes or required information in the proposal submission may be considered non-responsive.
Update #1 ·
The Federal Deposit Insurance Corporation invites you to submit a proposal for the Software Supply Chain Security Solution. The Section B Price Schedule is within the attached RFP, but we require all offerors to complete the Software Supply Chain Container Excel Worksheet file (separate attachment to this contract opportunity). Please follow ALL instructions when completing the workbook. The RFP is non-transferable, unless approved in advance by the Contracting Officer. Please refer to the RFP package for all the requirements of this acquisition.
Offerors are also required to complete the Pre-Award Supply Chain Risk Management spreadsheet attachment in accordance with the solicitation requirements.
Please be sure to clearly indicate on the proposal response all contact information (i.e. account representative name, email addresses and phone numbers). Offerors shall pay particular attention to Section 7.3.1-06 “Identification and Delivery of Proposals-March 2009” of the RFP for specific proposal submission instructions.
Any questions regarding the solicitation shall be submitted to Hamilton Jackson at hamjackson@fdic.gov no later than 12:00 p.m. (noon) Friday, October 2, 2026.
To be considered for this opportunity, offerors shall provide all information required in the RFP, by 1 p.m. Friday, October 9, 2026.
Any missing volumes or required information in the proposal submission may be considered non-responsive.
Files
| File | Type | Posted |
|---|---|---|
| Software Supply Chain Container Price Schedule 10.14.26.xlsx | XLSX spreadsheet | |
| CORHQ-26-R-0394 A0002 Questions and Answers.pdf | ||
| CORHQ-26-R-0394 Updated 10.14.26.pdf | ||
| CORHQ-26-R-0394 Updated 10.8.26.pdf | ||
| CORHQ-26-R-0394 A00001 Extend RFP Due Date.pdf | ||
| CORHQ-26-R-0394 Software Supply Chain Container.pdf | ||
| Software Supply Chain Container Price Schedule 9.28.26.xlsx | XLSX spreadsheet | |
| Pre-Award SCRM Info.xlsx | XLSX spreadsheet |
Similar open opportunities
| Opportunity | Agency | Set-aside | Responses due |
|---|---|---|---|
| IBM Mainframes and Maintenance for the FDIC | Federal Deposit Insurance Corporation | No set-aside |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity