DOI - IBC C-SCRM Tool Solution - MRAS

The U.S. Department of the Interior (DOI) is seeking a Cybersecurity Supply Chain Risk Management (C-SCRM) Tool Solution to enhance its cybersecurity capabilities. The DOI relies on multiple information systems that require secure and effective supply chain management to mitigate risks. The C-SCRM Tool Solution will enable DOI personnel to streamline and automate processes related to identifying, assessing, monitoring, reporting, managing, and mitigating cybersecurity supply chain risks associated with ICT suppliers, products, and services. The implementation of the tool will occur in a phased approach, starting with critical systems and contracts.

The scope of the C-SCRM Tool Solution includes several use cases such as supplier/product/entity assessment, product/producer assurance, continuous monitoring and alerting, sharing information securely, data visualization and reporting, and integration with key systems and data sources. The tool should support federal guidance on C-SCRM and securing the software supply chain while being scalable and considering security, user experience, records, legal constraints, and implementation time frame implications.

The period of performance for this effort is one year with four one-year option periods. The implementation support may be required on-site or off-site at DOI facilities located in Denver, CO; Lakewood, CO; Washington DC; and Reston VA. Remote work may also be authorized depending on duties and needs. The standard workweek is 40 hours from Monday to Friday, excluding federal holidays.

Deliverables for this project include a project WBS/plan/schedule, status reports/meetings, final implementation plan, training plan, and other ad-hoc deliverables as required. The DOI prefers implementing the C-SCRM Tool Solution via a software as a service (SaaS) model hosted in a FedRAMP approved cloud environment to minimize impact on DOI resources.

Overall, this opportunity presents a significant contract for a C-SCRM Tool Solution that will enhance the DOI's cybersecurity supply chain risk management capabilities and support its mission-critical information systems.