Software Supply Chain Security Solution

The Federal Deposit Insurance Corporation (FDIC) is seeking a firm‑fixed‑price vendor to provide a comprehensive Software Supply‑Chain Security Solution. The effort includes delivering up to 50 hardened container images, ongoing software maintenance, a management portal integrated with JFrog Artifactory and Azure Entra ID, continuous vulnerability scanning, and generation of SBOMs in SPDX or CycloneDX format. In addition, the contractor must provide professional services for integration, security‑control documentation, and training during the initial performance period. The contract is a one‑year base period with four optional one‑year renewals, totaling up to five years of service. • 50 licensed container images (Alpine, Red Hat, NGINX, Tomcat, Spring Boot) with FedRAMP Moderate, DISA STIG, and CIS benchmark compliance. • Continuous vulnerability management – zero‑day remediation within 48 hours, SLA‑based response times for critical, high, medium, and low severity findings. • Integrated portal & CLI for image catalog, SSO (Active Directory/Azure Entra ID), RBAC, and automated notifications. • Professional services (≈300 hours) for integration, training, and security‑control documentation (SSP, SAR, POA&M). • Mandatory pre‑award Supply‑Chain Risk Management data and post‑award reporting requirements.