19AQMM26Q0440 FE.pdf

Document Number: 19AQMM26Q0440 PROCESSED Page 1 of 13

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24 & 30 1. REQUISITION NUMBER PAGE 1 OF 13

5. SOLICITATION NUMBER

19AQMM26Q0440

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE DATE

08/26/2026

4. ORDER NUMBER 6. SOLICITATION ISSUE

DATE

08/26/2026

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME Shuang (Lily) Fangio

b. TELEPHONE NUMBER (No collect calls) 703-913-8953

8. OFFER DUE DATE / LOCAL

TIME

08/31/2026

11:00 ET

CODE GAAM_

BUREAU OF GLOBAL ACQUISITIONS (GA)

1200 Wilson Blvd., SA-6B

ATTN: GA

ARLINGTON, VA 22209

9. ISSUED BY UNRESTRICTED OR X SET ASIDE: 100.00 % FOR

X SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED WOMEN-

OWNED SMALL BUSINESS (EDWOSB)

8(A)

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS): 423430

SIZE STANDARD: 250 Employees

10. THE ACQUISITION IS

SEE

SCHEDULE

11. DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS BLOCK IS

MARKED

0 Days: 0.00 %

0 Days: 0.00 % 0 Days: 0.00 % 0 Days: 0.00 %

12. DISCOUNT TERMS

13a. THIS CONTRACT IS

RATED ORDER UNDER THE

DEFENSE PRIORITIES AND

ALLOCATIONS SYSTEM -

DPAS (15 CFR 700)

13b. RATING

X REQUEST

FOR

QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

14. METHOD OF SOLICITATION

CODE15. DELIVER TO CODE GAAM16. ADMINISTERED BY

Security Staffing & Countermeasures

GA/AM/DMS/SEC/SSC

Bureau of Global Acquisitions 1200 Wilson Blvd (SA-06B) Arlington, VA 22209

FACILITY

CODE

CODE

Contact UEI:

Telephone No.

17a. CONTRACTOR/

OFFEROR

IPPCODE18a. PAYMENT WILL BE MADE BY

IPP

Invoices to be uploaded to Invoice Processing Platform at http://www.ipp.gov

CHARLESTON, SC 29415

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER SEE ADDENDUM

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS

CHECKED

19. ITEM NUMBER 20. SCHEDULE OF SUPPLIES/SERVICES

(Use Reverse and/or Attach Additional Sheets as Necessary)

21. QUANTITY 22. UNIT 23. UNIT PRICE 24. AMOUNT

See Line Information

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA X ARE ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN ____ COPIES TO

ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH

OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE

TERMS AND CONDITIONS SPECIFIED.

29. AWARD OF CONTRACT: REFERENCE _____________________________

OFFER DATED _________________ . YOUR OFFER ON SOLICITATION (BLOCK

5) INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF THE CONTRACTING OFFICER (TYPE OR PRINT) Elizabeth K Surette

31c. DATE SIGNED 08/26/2026

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

Document Number: 19AQMM26Q0440 PROCESSED Page 2 of 13

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: _________________________________

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

PARTIAL FINAL

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

COMPLETE PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 11/2021) BACK

Document Number: 19AQMM26Q0440 PROCESSED Page 3 of 13

Section A - Solicitation/Contract Form

Line Item Summary

Solicitation Number:

19AQMM26Q0440

Contract Number: Title:

Claroty Fly Away Kit Pro Licenses and Training TIE

Date of Solicitation:

08/26/2026

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: 7A21

PSC Description: IT AND TELECOM - BUSINESS

APPLICATION SOFTWARE (PERPETUAL LICENSE

SOFTWARE)

Type of Contract Pricing: Firm Fixed Price

2.0 EA $0.00 $0.00

Delivery Schedule:

Delivery Number Delivery Description Delivery Date Quantity FOB Point 1 Delivery On Or Before 09/08/2026 1.000000 Other

Period of Performance: 09/08/2026 - 09/07/2027

Description: Claroty Fly Away Kit Pro (Up to 10 Assessments for 1 Yr) Part Number: CL-FED-EA-PRO

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: 7A21

PSC Description: IT AND TELECOM - BUSINESS

APPLICATION SOFTWARE (PERPETUAL LICENSE

SOFTWARE)

Type of Contract Pricing: Firm Fixed Price

1.0 EA $0.00 $0.00

Delivery Schedule:

Delivery Number Delivery Description Delivery Date Quantity FOB Point 1 Delivery On Or Before 09/08/2026 1.000000 Other

Period of Performance: 09/08/2026 - 09/07/2027

Description: CTD Remote Training (Custom) single session up to to 10 students Part Number: PS-CTD-TRN-SINGLSESSION

CLIN Funding: Cost:

Base Totals: $0.00 $0.00

Exercised Options Totals: $0.00 $0.00

Unexercised Options Totals: $0.00 $0.00

Base and Options Totals: $0.00 $0.00

52.252-2 - Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/ these address(es):

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide https://www.acquisition.gov/dosar [Insert one or more Internet addresses] (End of clause)

52.252-1 - Solicitation Provisions Incorporated by Reference (Feb 1998)

Document Number: 19AQMM26Q0440 PROCESSED Page 4 of 13

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide https://www.acquisition.gov/dosar [Insert one or more Internet addresses] (End of provision) Clause Title Fill-ins

52.203-17 Contractor Employee Whistleblower Rights (Nov 2023)

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or

Statements (Jan 2017)

52.204-13 System for Award Management-Maintenance (DEVIATION JAN 2026)

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment (Nov 2021)

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations

(DEVIATION JAN 2026)

52.212-4 Terms and Conditions-Commercial Products and Commercial Services

(DEVIATION JAN 2026)

52.219-6 Notice of Total Small Business Set-Aside (DEVIATION FEB 2026)

52.222-36 Equal Opportunity for Workers with Disabilities (DEVIATION FEB 2026)

52.222-50 Combating Trafficking in Persons (DEVIATION FEB 2026)

52.222-90 Addressing DEI Discrimination by Federal Contractors (DEVIATION APR

2026)

52.232-33 Payment by Electronic Funds Transfer-System for Award Management (Oct

2018)

52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013)

52.232-40 Providing Accelerated Payments to Small Business Subcontractors (Mar

2023)

52.240-91 Security Prohibitions and Exclusions (DEVIATION JAN 2026)

52.240-90 Security Prohibitions and Exclusions Representations and Certifications

(DEVIATION JAN 2026)

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal

Confidentiality Agreements or Statements--Representation (Jan 2017)

Document Number: 19AQMM26Q0440 PROCESSED Page 5 of 13

Clause Title Fill-ins

52.204-7 System for Award Management - REGISTRATION (DEVIATION JAN

2026)

52.212-1 Instructions to Offerors-Commercial Products and Commercial Services

(DEVIATION JAN 2026)

652.206-70 ADVOCATE FOR COMPETITION/OMBUDSMAN (JUN 2025)

B-010 - TYPE OF CONTRACT

This is a Firm-Fixed Price purchase order.

(end of clause)

F-006 - PERIOD OF PERFORMANCE

Period of Performance (POP): One year from date of award. Estimated POP is 9/8/2026-9/7/2027.

F-009 - PLACE OF DELIVERY

The Vendor shall provide the requirements by 9/8/2026 or date of award.

The Vendor shall provide any software/license keys as well confirmations and/or receipts to the following email addresses:

ValliereJR@state.gov RedingerSW@state.gov

The Vendor shall use the below address for shipment of any required physical items if applicable:

U.S. Department of State, DS/CTS/TIE/ET

SA-20/FL14 14L27

2201 C Street NW Washington, DC 20522-2014

652.239-800 - Cybersecurity Supply Chain Risk Management Requirements (AUG 2026) (DEVIATION)

(a) Definitions. As used in this clause:

Covered article - The term "covered article" includes-

(1) "Information and Communications Technology" which is an industry term for information technology that is involved in integrating telecommunications (e.g., telephone lines and wireless

Document Number: 19AQMM26Q0440 PROCESSED Page 6 of 13 signals) and computers to enable users to access, store, manipulate, transmit, and receive digital information. This includes software, software as a service, digital and data services, and hardware components that support information creation, storage, transfer, and management, like computers and smartphones.

(2) “Operational Technology” (OT) is defined as programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events.

Examples of OT include industrial control systems, building management systems, fire control systems, physical access control mechanisms, and internet of things devices.

(3) “Critical software” refers to any software, firmware, or cloud-based application—including its direct dependencies—that performs functions vital to the organization’s security posture and operational integrity. This includes any tool that manages elevated privileges, possesses direct access to networking and computing resources, or controls access to data and operational technology. Furthermore, any software that performs essential trust functions or operates across security boundaries is classified as critical, as its compromise would grant an attacker significant control or visibility into the broader environment.

(4) "Telecommunications Equipment", which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

(5) "Telecommunications Service", which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

(6) Cybersecurity Supply Chain Risk: The term cybersecurity supply chain risk means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

(7) Incident: The term incident means per the Federal Information Security Modernization Act of 2014, “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

(8) Vulnerability: The term vulnerability which means any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

(b) Contractor Cybersecurity Supply Chain Risk Management Responsibilities.

The Contractor must regularly identify, assess, monitor, and mitigate

Document Number: 19AQMM26Q0440 PROCESSED Page 7 of 13 cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

(c) Supporting Government Cybersecurity Supply Chain Risk Assessments. No more than an estimated once per year, the Contractor must provide any requested information related to its supply chain within 10 business days except information that is protected by a non-disclosure agreement with its customers (e.g., another federal agency).

(d) Novation Agreement Notice. FAR 42.1203 requires Government approval of novation agreements. For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

(e) Notification procedures for cybersecurity supply chain incidents. When an incident occurs, the Contractor must contact the CO or their designee within 72 hours of the incident.

(f) Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

(g) Attestation following Major Version Change. For critical software, as defined by NIST Guidance, provided under the contract that required an approved Secure Software Development Attestation Form, the responses on this form apply to the software’s major version changes (e.g., using a semantic versioning schema of Major.Minor.Patch, the software version number goes from 2.5 to 3.0) unless the Contractor otherwise notifies the Contacting Officer that the form is no longer valid. This notification to the Contracting Officer must be submitted within 15 days of the major version change and must include a new completed and signed Secure Software Development Attestation Form.

(End of clause)

G-002 - CONTRACT ADMINISTRATION DATA

Contracting Officer: Elizabeth Surette Email: SuretteEK@state.gov

Contract Administrator: Lily Fangio Email: FangioS@state.gov

INV-IPP - ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS AND INSTRUCTIONS TO IMPLEMENT

USAGE OF THE INVOICE PROCESSING PLATFORM (IPP).

(a) Definitions. As used in these instructions

Document Number: 19AQMM26Q0440 PROCESSED Page 8 of 13

(1)”Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of these instructions, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP) at www.ipp.gov. Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with the IPP application can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866)973-3131. The Contractor shall ensure that its supporting documentation conforms to IPP requirements. IPP accommodates up to 25 supporting attachments per invoice, individual attachment file size may not exceed ten megabytes (10mb). If the Contractor assesses that their supporting documentation will not reasonably conform to IPP requirements, the Contractor shall contact the Contracting Officer to explore possible alternatives. In addition, the IPP only allows certain characters to be used as the invoice number. The invoice number shall conform to the IPP convention and the attachments (if used) shall match exactly the invoice number allowed. The allowed characters in the IPP are “abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_”

(c) If the Contractor wishes to be paid via a foreign bank account, the contractor must properly fill out form GFS-FO-CLM-089 and attach it to each invoice in the IPP where payment to a foreign bank account is requested. The form can obtained by e-mailing CGFSIPPITSForm@state.gov.

(d) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing.

(e) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

[End of instructions]

H-024 - NONPAYMENT FOR UNAUTHORIZED WORK

No payments will be made for any unauthorized supplies or services, or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor of his own volition or at the request of an individual other than a duly appointed Contracting Officer. Only a duly appointed Contracting Officer is authorized to change the specifications, terms, and/or conditions of this contract.

(end of clause)

H-050 - COMPLIANCE WITH FEDERAL ANTI-DISCRIMINATION LAWS - CERTIFICATION (EO 14173, January 2025)

(a) Definition. As used in this provision - Program promoting diversity, equity, and inclusion means a program whose purpose is to promote preferences based on race, color, religion, sex, or national origins, such as in training or hiring.

(b) Certification. By submission of its offer, the Offeror certifies that it does not operate any programs promoting diversity, equity, and inclusion that violate any applicable Federal anti-discrimination laws.

(End of provision)

Document Number: 19AQMM26Q0440 PROCESSED Page 9 of 13

52.219-28 - Postaward Small Business Program Rerepresentation (DEVIATION FEB 2026)

(a) Definitions. As used in this clause— Long-term contract means a contract of more than five years in duration, including options. However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to Extend Services, or other appropriate authority.

Small business concern—

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (c) of this clause.

(2) Affiliates, as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others.

In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

(b) If the Contractor represented that it was a small business concern, a small disadvantaged business concern, or a joint venture that was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall rerepresent its size and socioeconomic status according to paragraph (e) of this clause or, if applicable, paragraph (g) of this clause, upon occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts-

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) The Contractor shall rerepresent its size status in accordance with the size standard in effect at the time of this rerepresentation that corresponds to the North American Industry Classification System (NAICS) code(s) assigned to this contract. The small business size standard corresponding to this NAICS code(s) can be found at https://www.sba.gov/ document/support--table-size-standards.

(d) The small business size standard for a Contractor providing an end item that it does not manufacture, process, or produce itself, for a contract other than a construction or service contract, is 500 employees, or 150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition—

(1) Was set aside for small business and has a value above the simplified acquisition threshold;

(2) Used the HUBZone price evaluation preference regardless of dollar value, unless the Contractor waived the price evaluation preference; or

(3) Was an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(e) Except as provided in paragraph (g) of this clause, the Contractor shall make the representation(s) required by paragraph

(b) of this clause by validating or updating all its representations in the Representations and Certifications section of the System for Award Management (SAM) and its other data in SAM, as necessary, to ensure that they reflect the Contractor's current status. The Contractor shall notify the contracting officer in writing within the timeframes specified in paragraph (b) of this clause, that the data have been validated or updated, and provide the date of the validation or update.

(f) If the Contractor represented that it was other than a small business concern prior to award of this contract, the Contractor may, but is not required to, take the actions required by paragraphs (e) or (g) of this clause.

(g) If the Contractor does not have representations and certifications in SAM, or does not have a representation in SAM for the NAICS code applicable to this contract, the Contractor is required to complete the following rerepresentation and submit it to the contracting office, along with the contract number and the date on which the rerepresentation was completed:

(1) The Contractor represents that it __ is, __ is not a small business concern under NAICS Code ____________ assigned to contract number ____________________.

(2) [Complete only if the Contractor represented itself as a small business concern in paragraph (h)(1) of this clause.] The Contractor represents that it __ is, __ is not, a small disadvantaged business concern as defined in 13

CFR 124.1001.

(3)Women-owned small business (WOSB) joint venture eligible under the WOSB Program. The Contractor represents that it __ is, __ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [The Contractor shall enter the name and unique entity identifier of each party to the joint venture:

(4) Economically disadvantaged women-owned small business (EDWOSB) joint venture. The Contractor represents that it __ is, __ is not a joint venture that complies with the requirements of 13 CFR 127.506(a)

Document Number: 19AQMM26Q0440 PROCESSED Page 10 of 13 through (c). [The Contractor shall enter the name and unique entity identifier of each party to the joint venture:

(5) Service-disabled veteran-owned small business (SDVOSB) joint venture eligible under the SDVOSB Program.

The Contractor represents that it __ is, __ is not an SDVOSB joint venture eligible under the SDVOSB Program that complies with the requirements of 13 CFR 128.402. [The Contractor shall enter the name and unique entity identifier of each party to the joint venture: ____________________.]

(6) HUBZone joint venture eligible under the HUBZone Program.[ Complete only if the offeror is a HUBZone small business concern. ] The offeror represents, as part of its offer, that It __ is, __ is not a HUBZone joint venture that complies with the requirements of 13 CFR 126.616(a) through (c). [ The Contractor shall enter the name and unique entity identifier of each party to the joint venture: ____________________.] Each HUBZone small business concern participating in the HUBZone joint venture must be certified as a HUBZone concern. [ Contractor to sign and date and insert authorized signer's name and title.

(End of clause)

52.209-2 - Prohibition on Contracting with Inverted Domestic Corporations--Representation (DEVIATION JAN 2026)

(a) Definitions. As used in this clause— Inverted domestic corporation means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

Subsidiary means an entity in which more than 50 percent of the entity is owned—

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

(b) Government agencies are not permitted to use appropriated (or otherwise made available) funds for contracts with either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation, unless the exception at 9.108-3(b) applies or the requirement is waived in accordance with the procedures at 9.108-5.

(c) Representation. The Offeror represents that-

(1) It __is, __is not an inverted domestic corporation; and

(2) It __is, __is not a subsidiary of an inverted domestic corporation.

52.209-11 - Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law (DEVIATION JAN 2026)

(a) The Government will not enter into a contract with any corporation that—

(1) Has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless an agency has considered suspension or debarment of the corporation and made a determination that suspension or debarment is not necessary to protect the interests of the Government; or

(2) Was convicted of a felony criminal violation under any Federal law within the preceding 24 months, where the awarding agency is aware of the conviction, unless an agency has considered suspension or debarment of the corporation and made a determination that this action is not necessary to protect the interests of the Government.

(b) The Offeror represents that–

(1) It is __ is not __ a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability; and

(2) It is __ is not __ a corporation that was convicted of a felony criminal violation under a Federal law within the preceding 24 months.

Document Number: 19AQMM26Q0440 PROCESSED Page 11 of 13

52.219-1 - Small Business Program Representations (DEVIATION FEB 2026)

(a) Definitions. As used in this provision- Economically disadvantaged women-owned small business (EDWOSB) concern means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300. It automatically qualifies as a women-owned small business concern eligible under the WOSB Program.

HUBZone small business concern means a small business concern that meets the requirements described in 13 CFR 126.200, is certified by the Small Business Administration (SBA) and designated by SBA as a HUBZone small business concern in the Small Business Search (SBS) ( 13 CFR 126.103).

Service-disabled veteran-owned small business (SDVOSB) concern eligible under the SDVOSB Program means an SDVOSB concern that is designated in the System for Award Management (SAM) as certified by the Small Business Administration (SBA) in accordance with 13 CFR 128.300.

Small business concern—

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (b) of this provision.

(2) Affiliates, as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others.

In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

Small disadvantaged business concern means a small business concern that-

(1) Is at least 51 percent unconditionally and directly owned (as defined at 13 CFR 124.105) by one or more socially disadvantaged (as defined at 13 CFR 124.103) and economically disadvantaged (as defined at 13 CFR 124.104) individuals who are citizens of the United States, and

(2) The management and daily business operations of which are controlled (as defined at 13 CFR 124.106) by individuals who meet the criteria in paragraph (1) of this definition.

Women-owned small business (WOSB) concern eligible under the WOSB Program (in accordance with 13 CFR part 127) means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300.

(b) (1) The North American Industry Classification System (NAICS) code for this acquisition is _______________[insert NAICS code].

(2) The small business size standard is _______________ [insert size standard].

(3) The small business size standard for a concern that submits an offer, other than on a construction or service acquisition, but proposes to furnish an end item that it did not itself manufacture, process, or produce (i.e., nonmanufacturer), is 500 employees, or 150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition—

(i) Is set aside for small business and has a value above the simplified acquisition threshold;

(ii) Uses the HUBZone price evaluation preference regardless of dollar value, unless the offeror waives the price evaluation preference; or (iii)Is an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(c) Representations. (1) The offeror represents as part of its offer that—

(i) It __ is, __ is not a small business concern; or (ii)It __ is, __ is not a small business joint venture that complies with the requirements of 13 CFR 121.103(h) and 13 CFR 125.8(a) and (b). [The offeror shall enter the name and unique entity identifier of each party to the joint venture: _________________________.]

(2)[Complete only if the offeror represented itself as a small business concern in paragraph (c)(1) of this provision.] The offeror represents that it __ is, __ is not a women-owned small disadvantage business concern.

(3) Women-owned small business (WOSB) joint venture eligible under the WOSB Program. The offeror represents as part of its offer that it __ is, __ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture:

Document Number: 19AQMM26Q0440 PROCESSED Page 12 of 13

(4) Economically disadvantaged women-owned small business (EDWOSB) joint venture. The offeror represents as part of its offer that it __ is, __ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture:

(5) SDVOSB joint venture eligible under the SDVOSB Program. [Complete only if the offeror is certified as a SDVOSB concern]. The offeror represents as part of its offer that it __ is, __ is not a SDVOSB joint venture eligible under the SDVOSB Program that complies with the requirements of 13 CFR 128.402. [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: _________________________.]

(6) HUBZone joint venture eligible under the HUBZone Program. [Complete only if the offeror is a HUBZone small business concern.] The offeror represents, as part of its offer, that it __ is, __ is not a HUBZone joint venture that complies with the requirements of 13 CFR 126.616(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: _________________________.] Each HUBZone small business concern participating in the HUBZone joint venture must be certified as a HUBZone concern.

(d) Notice. Under 15 U.S.C. 645(d), any person who misrepresents a firm’s status as a business concern that is small, HUBZone small, small disadvantaged, service-disabled veteran-owned small, economically disadvantaged women-owned small, or women-owned small eligible under the WOSB Program in order to obtain a contract to be awarded under the preference programs established pursuant to section 8, 9, 15, 31, and 36 of the Small Business Act or any other provision of Federal law that specifically references section 8(d) for a definition of program eligibility, will be—

(1) Punished by imposition of fine, imprisonment, or both;

(2) Subject to administrative remedies, including suspension and debarment; and

(3) Ineligible for participation in programs conducted under the authority of the Act.

Addendum to FAR 52.212-1 - Instructions to Offerors—Commercial Products and Commercial Services

(a) Submission of offers.

(7) C-SCRM Quote Instructions Cybersecurity Supply Chain Risk Management (C-SCRM) Forms The offeror shall include in its offer Attachment 1: C-SCRM Questionnaire. In lieu of a completed C-SCRM Questionnaire, the vendor may submit a third party authorizing official conducted assessment, such as ISO 27001, ISO 9000, SOC II, or FEDRAMP authorization.

(End of provision)

52.212-2 - Evaluation-Commercial Products and Commercial Services (DEVIATION JAN 2026)

(a) Evaluation factors. The Government will award a contract resulting from this solicitation to the responsible Offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered.

The following factors will be used to evaluate offers:

See Addendum ____________________________________________________________

[Insert evaluation factors in the relative order of importance. For requests for proposals, state: Evaluation factors other than price when combined are [significantly more important than price/approximately equal to price/significantly less important] than price. For invitations for bids, list only price and price-related factors.]

(b) Options (if applicable). The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. The evaluation of options does not obligate the Government to exercise the option(s).

(c) Notice of award. A written notice of award or acceptance of an offer furnished to the successful Offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

Document Number: 19AQMM26Q0440 PROCESSED Page 13 of 13

Addendum to FAR 52.212-2 - Evaluation—Commercial Products and Commercial Services

This is a sole-source solicitation issued in accordance with the brand-name justification. The Government intends to award a purchase order to the offeror, provided that the offeror's quotation is determined technically acceptable, the price is determined fair and reasonable, and the offeror receives a "GO" rating under the Cybersecurity Supply Chain Risk Management (C-SCRM) factor described below, and conforms to the requirements of this solicitation.

The basis for the Government's award determination, in no specific order of importance, is: Technical Capability, Price, and the Cybersecurity Supply Chain Risk Management (C-SCRM) GO/NO-GO Factor. Only a quotation that receives a "GO" rating for C- SCRM will be evaluated for Technical Capability and Price.

Technical Capability will be evaluated by how well the items offered in the quotation meet the Government's Requirement.

Price will be evaluated for reasonableness IAW FAR 12.204(a).

C-SCRM GO/NO-GO Evaluation Factor

Cybersecurity Supply Chain Risk Management (C-SCRM) Forms The offeror must include in its offer Attachment 1, C-SCRM Questionnaire. In lieu of a completed C-SCRM Questionnaire, the vendor may submit a third party authorizing official conducted assessment, such as ISO 27001, ISO 9000, System and Organizational Controls (SOC) II, or FedRAMP authorization.

The document must be completed in accordance with the attachment’s instructions. Failure to follow the attachment’s instructions may result in rejection of the offer.

This factor is evaluated on a go/no-go basis. The Government will evaluate if the submitted C-SCRM Questionnaire and State Department Secure Software Development Attestation Form meet the definition for the “Go” or “No-Go” ratings for this factor. The “Go” and “No-Go” ratings and their definitions are as follows:

GO: The proposal meets the criteria in the following paragraph.

The C-SCRM Questionnaire contains both of the following: (1) C-SCRM Questionnaire instructions are completed; and (2) contains Yes answers for all questions in Sections 2 and 3 of the questionnaire; or the vendor has submitted a third party authorizing official conducted assessment such as, ISO 27001, ISO 9000, SOC II, or FedRAMP authorization.

NO-GO: The proposal does not meet one (1) or more of the criteria in the following paragraph.

The C-SCRM Questionnaire contains both of the following: (1) C-SCRM Questionnaire instructions are completed; and (2) contains Yes answers for all questions in Sections 2 and 3 of the questionnaire; or the vendor has submitted a third party authorizing official conducted assessment such as, ISO 27001, ISO 9000, SOC II, or FedRAMP authorization.