Supply Chain Risk Management Tool

Background
The Universal Service Administrative Company (USAC) is seeking information from US-based companies to provide a Supply Chain Risk Management Tool. USAC administers the Universal Service Fund (USF) programs on behalf of the Federal Communications Commission (FCC), aiming to promote quality telecommunications services and expand access to advanced telecommunications services across the nation.

The goal of this RFI is to gather information on software applications that support cybersecurity supply chain risk management in compliance with federal standards.

Work Details
The requested Supply Chain Risk Management Tool should have the following functionalities:

1. Assess and rate the security practices of vendors and potential vendors, including scanning for vulnerabilities and providing a security score.
2. Evaluate vendors prior to purchase/license renewals and on an ad hoc basis post-purchase/renewal.
3. Provide timely alerts regarding cybersecurity incidents affecting vendors in USAC's supply chain.
4. Collect customizable questionnaire responses from vendors regarding their ICT supply chain visibility and security compliance.
5. Assist in vendor deep dives using open-source information to build vendor risk profiles.
6. Ideally obtain usable software bills of materials (SBOMs) and hardware bills of materials (HBOMs) from vendors.
7. Provide an Application Programming Interface (API) for integration with procurement applications to verify risks before executing purchases.

Period of Performance
The RFI was issued on November 15, 2024, with responses due by December 16, 2024.

Place of Performance
The contract will be performed at USAC's location in Washington, DC.