This government document outlines a Cybersecurity Supply Chain Risk Management (C-SCRM) questionnaire aimed at vendors participating in federal RFPs. It requires vendors to provide their contact information and details about their risk management practices related to cybersecurity and personnel security. Key sections include Vendor Risk Management Plan, Physical and Personnel Security, and specific inquiries into the identification and management of supply chain threats. Vendors must detail their policies for conducting employee background checks, ensure tampering prevention of ICT equipment, and indicate whether they provide training on insider threat recognition. The document emphasizes the necessity for organizations to have written SCRM requirements in supplier contracts and verification of compliance, ensuring that federal standards, such as NIST SP 800-53, are met. Ultimately, the questionnaire serves as a tool for the government to assess vendor preparedness in mitigating cybersecurity risks within the supply chain, supporting better decision-making in contract awards and grant allocations.

The Secure Software Development Attestation Form, issued by the Department of State, is designed to ensure that software used by federal agencies is developed securely, in accordance with a framework established by the National Institute of Standards and Technology (NIST). Triggered by Executive Order 14028, the form collects information from software producers who attest to meeting specified secure development practices. It mandates self-attestation for software developed or significantly modified after September 14, 2022, ensuring that software meets minimum security requirements before adoption by federal agencies. Key elements include a clear definition of requirements based on the NIST Secure Software Development Framework, supporting the government's goal of enhancing cybersecurity within the software supply chain. The form captures essential producer and software details, mandates completion by a corporate officer, and allows the use of third-party assessments for compliance verification. Exemptions include software developed by federal agencies and open-source software. The document outlines procedures for submitting the attestation and emphasizes the need for rigorous development practices to safeguard cybersecurity. Ultimately, it reflects the federal government's commitment to protecting information systems through secure software development practices aimed at minimizing cybersecurity risks.

The U.S. Department of State's Bureau of Diplomatic Technology issued a Request for Information (RFI) seeking industry input on high availability server and storage hardware solutions for global deployment across numerous sites. The RFI aims to assess market capabilities of proven commercial off-the-shelf (COTS) hardware that meets specific Department requirements, including compliance with federal security standards and cryptographic module certifications. Vendors are invited to demonstrate their solutions through detailed submissions addressing company capabilities, functional requirements, and past performance in similar federal contexts. Key requirements include hardware that supports rapid deployment, direct support services, a complete parts breakdown, and a commitment to long-term software and firmware support. Additionally, specific hardware configurations for both overseas and domestic operations are outlined, emphasizing high availability, scalability, and the ability to meet evolving technology needs. Responses to the RFI, due by March 5, 2025, will assist the Department in gauging interest and determining acquisition strategies, though this RFI does not commit the government to procure any goods or services.