Supply Chain Illumination RFI

The Federal Bureau of Investigation's Finance and Facilities Division is conducting a Request for Information (RFI) to identify commercially available Supply Chain Risk Management (SCRM) illumination tools and services capable of assessing threats, risks, and vulnerabilities in information and communication technology (ICT) products and services. The solution must deliver comprehensive capabilities including micro component traceability to at least three tiers upstream, software bill of materials (SBOM) and hardware bill of materials (HBOM) generation, supply chain relationship mapping, and reliable product and vendor information. Key requirements include continuous monitoring with automated risk alerts, due diligence supply chain illumination, data visualization with exportable reporting, structured product and vendor registries, and integration capabilities with FBI enterprise systems via APIs. The platform must evaluate financial, operational, cyber, governance, third-party, trade, and product risks while maintaining FedRAMP authorization, Section 508 accessibility compliance, and support for on-premises or secure government cloud deployment. The deadline for vendor questions is April 17, 2026, at noon Eastern Time, with answers posted on SAM.gov by April 24, and complete RFI responses are due by May 6, 2026, at 3:00 PM Eastern Time via email to Brandon James (bmjames@fbi.gov) and Harriett Williams (hlwilliams@fbi.gov).

This RFI is issued with no set-aside designation and represents an information-gathering effort rather than a formal solicitation or commitment to award a contract. No incumbent contractor is identified in the materials, and no specific budget range or award value is disclosed at this pre-solicitation stage. The initial deployment scope is limited to 15-20 users monitoring approximately 500 vendors on an unclassified network, with FedRAMP Moderate authorization initially acceptable rather than FedRAMP High. Responses must not exceed 20 single-sided pages with one-inch margins and 12-point minimum font, submitted in Microsoft Word, Excel, PowerPoint, or PDF format. The FBI will not provide integrations with enterprise systems on day one and requires outputs in standard formats, while preferring tiered licensing models based on user count and ongoing vendor sustainment and operational support. All submissions are strictly voluntary, unclassified, and no funds are available to reimburse response preparation costs.