26Q0021_RFQ_IPhones_Amendment0001.pdf

COMBINED SYNOPSIS/SOLICITATION FOR A COMMERCIAL PRODUCT

The U.S. Embassy in Panama has a requirement for the purchase of twenty-five (25)ea iPhones 16 Pro Max.

Please note that this is a combined synopsis/solicitation for a commercial product prepared in accordance with

FAR part 12, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; offers are being requested, and a separate written solicitation will not be issued. The solicitation number is 19PM0726Q0021 and is issued as a Request for Quotation. This acquisition is not set-aside for small business concerns. This solicitation incorporates provisions and clauses by reference. The full text of provisions and clauses may be accessed electronically at https://www.acquisition.gov/far-overhaul . Items to be acquired:

Item Description Qty

Unit

Price Total iPhones 16 Pro Max 256 GB

• Phone Type: Smartphones

• Brand: Apple

• Model: MYWV3BEA

• Phone capacity: 256 GB

• Screen size: 6.9 inches

• Type of screen: OLED

• Resolution: 2868 x 1320 to 460 ppi

• Product width: 77.6 mm

• Product depth: 8.25 mm

• Product height: 163 mm

• Mobile phones bands: Wi-Fi + Data

• Bluetooth: 5.3

• Water-resistant: Yes

• Wi-Fi: Yes

• Operating System: iOS 18

• Connector Type: USB-C

• Vendor shall be an Authorized Apple local distributor and located in the country of Panama. Proposals received from vendors outside of the country of Panama will not be considered.

• Vendor shall provide the manufacture’s warranty and warranty service in Panama.

25 $ $

Deliver F.O.B. destination to U.S. Embassy Panama, located in Demetrio B. Lakas, Clayton, no later than Thirty

(30) calendar days after contract award.

FAR 52.212-1, Instructions to Offerors-Commercial Items, applies to this acquisition. ADDENDUM TO 52.212-1.

SUMMARY OF INSTRUCTIONS. Each offer must consist of the following:

A.1. CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT C-SCRM Quotation Instructions

(corresponding instructions to the factor below): Cybersecurity Supply Chain Risk Management (C-SCRM) Forms:

The offeror shall include in its offer a completed Attachment 1, C-SCRM In lieu of a completed C-SCRM

Questionnaire, the vendor may submit a third party authorizing official conducted assessment, such as ISO 27001, ISO 9000, SOC II, or FEDRAMP authorization.

A.2. Additional requirements for this acquisition:

▪ Provide a DESCRIPTIVE SPECIFICATIONS SHEET as part of the quotation.

https://www.acquisition.gov/far-overhaul

▪ The quotation shall include evidence of the prospective contractor’s commitment or explicit arrangement with a subcontractor (if any) demonstrating the vendor’s ability to acquire the required commodities, personnel necessary, resources, or warranty to fulfill the contract requirements.

FAR 52.212-2, Evaluation. Commercial Products and Services (Nov 2021). The preliminary evaluation process shall include the following:

Step 1: COMPLIANCE REVIEW. The Government will perform an initial review of quotations received to determine completeness and compliance with the terms of the solicitation to include CYBERSECURITY

SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) Go/No-Go Evaluation Factor.

This factor is evaluated on a go/no-go basis. The Government will evaluate if the submitted C-SCRM Questionnaire and State Department Secure Software Development Attestation Form meet the definition for the “Go” or “No-Go” ratings for this factor. The “Go” and “No-Go” ratings and their definitions are as follows:

RATING RATING DEFINITION

GO The proposal meets the criteria in the following two (2) paragraphs.

The C-SCRM Questionnaire contains both of the following: (1) C-SCRM Questionnaire instructions are completed; and (2) contains Yes answers for all questions in Sections 2 and 3 of the questionnaire; or the vendor has submitted a third party authorizing official conducted assessment such as ISO 27001, ISO 9000, SOC II, or FedRAMP authorization.

For suppliers offering any critical software, the State Department Secure Software

Development Attestation Form (or another federal agency’s equivalent form) is signed and submitted in accordance with the form’s instructions. In lieu of submitting the State

Department Secure Software Development Attestation Form, the offeror provides the information required by section “Additional Information” of the form and the Government finds that this information satisfactory mitigates associated risks.

NO-GO The proposal does not meet one (1) or more of the criteria in the following two (2) paragraphs.

The C-SCRM Questionnaire contains both of the following: (1) C-SCRM Questionnaire instructions are completed; and (2) contains Yes answers for all questions in Sections 2 and 3 of the questionnaire; or the vendor has submitted a third party authorizing official conducted assessment such as, ISO 27001, ISO 9000, SOC II, or FedRAMP authorization.

For suppliers offering any critical software, the State Department Secure Software

Development Attestation Form (or another federal agency’s equivalent form) is signed and submitted in accordance with the form’s instructions.

Step 2: LPTA Evaluation: For all offerors deemed to be acceptable under STEP #1 - Offers will be evaluated based on compliance with technical specifications, warranty coverage, delivery schedule, after-sales service options and overall cost. Only quotations meeting all minimum requirements will be considered for award. Award will be made to the Local vendor in Panama with the lowest priced, technically acceptable quotation.

FAR clause 52.212-4, Contract Terms and Conditions-Commercial items (DEVIATION JAN 2026), applies to this acquisition. Following FAR 52.252-2 the following provisions and clauses also are incorporated by reference and will apply to the resultant contract: 52.203-17 (JUN 2020), 52.203-19 (JAN 2017), [ 52.204-7, 52.204-9, 52.209-6

& 52.209-10 (DEVIATION JAN 2026)], 52.222-19 & 52.222.50 (DEVIATION FEB 2026), 52.226-8 (MAY 2024), 52.232-29 (NOV 2021),[ 52.233-3, 52.233-4, 52.240-90 & 52.240-91 (DEVIATION JAN 2026)], 52.244-6 (JAN

2025).

DOSAR clauses are incorporated by reference and will apply to the resultant contract as well: 652.242-73 (AUG

1999), 652.243-70 (AUG 1999) and the following clause in Full text:

DOSAR 652.239-800 CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT REQUIREMENTS

(DEVIATION)(AUG 2026)

(a) Definitions. As used in this clause:

Covered article - The term "covered article" includes-

(1) "Information and Communications Technology"which is an industry term for information technology that is involved in integrating telecommunications (e.g., telephone lines and wireless signals) and computers to enable users to access, store, manipulate, transmit, and receive digital information. This includes software, software as a service, digital and data services, and hardware components that support information creation, storage, transfer, and management, like computers and smartphones.

(2) “Operational Technology” (OT) is defined as programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events.

Examples of OT include industrial control systems, building management systems, fire control systems, physical access control mechanisms, and internet of things devices.

(3) “Critical software” refers to any software, firmware, or cloud-based application—including its direct dependencies—that performs functions vital to the organization’s security posture and operational integrity. This includes any tool that manages elevated privileges, possesses direct access to networking and computing resources, or controls access to data and operational technology. Furthermore, any software that performs essential trust functions or operates across security boundaries is classified as critical, as its compromise would grant an attacker significant control or visibility into the broader environment.]

(4) "Telecommunications Equipment", which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

(5) "Telecommunications Service", which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

(6) Cybersecurity Supply Chain Risk: The term cybersecurity supply chain risk means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or

(7) operation of the covered articles or information stored or transmitted on the covered articles.

(8) Incident: The term incident means per the Federal Information Security Modernization Act of

2014, “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

(9) Vulnerability: The term vulnerability which means any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

(b) Contractor Cybersecurity Supply Chain Risk Management Responsibilities. The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

(c) Supporting Government Cybersecurity Supply Chain Risk Assessments. No more than an estimated once per year, the Contractor must provide any requested information related to its supply chain within 10 business days except information that is protected by a non-disclosure agreement with its customers (e.g., another federal agency).

(d) Novation Agreement Notice. FAR 42.1203 requires Government approval of novation agreements.

For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

(e) Notification procedures for cybersecurity supply chain incidents. When an incident occurs, the

Contractor must contact the CO or their designee within 72 hours of the incident.

(f) Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

(g) Attestation following Major Version Change. For critical software, [as defined by NIST Guidance,] provided under the contract that required an approved Secure Software Development Attestation

Form, the responses on this form apply to the software’s major version changes (e.g., using a semantic versioning schema of Major.Minor.Patch, the software version number goes from 2.5 to

3.0) unless the Contractor otherwise notifies the Contacting Officer that the form is no longer valid.

This notification to the Contracting Officer must be submitted within 15 days of the major version change and must include a new completed and signed Secure Software Development Attestation

Form.

(End of clause)

DOSAR 652.239-801 DISCLOSURE OF AI USE CLAUSE (DEVIATION) (SEP 2025)

(a) Definitions. As used in this clause-

Artificial Intelligence (AI): The term "artificial intelligence" has the meaning provided in Section 238(g) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019.

i. This definition of AI encompasses, but is not limited to, the AI technical subfields of machine learning

(including deep learning as well as supervised, unsupervised, and semi-supervised approaches), reinforcement learning, transfer learning, and generative AI.

ii. This definition of AI does not include robotic process automation or other systems whose behavior is defined only by human-defined rules or that learn solely by repeating an observed practice exactly as it was conducted.

iii. For this definition, no system should be considered too simple to qualify as covered AI due to a lack of technical complexity (e.g., the smaller number of parameters in a model, the type of model, or the amount of data used for training purposes).

iv. This definition includes systems that are fully autonomous, partially autonomous, and not autonomous, and it includes systems that operate both with and without human oversight.

(b) Disclosure of AI Use in Contract Performance. When the Contractor or any of its subcontractors, vendors, or agents intends to incorporate AI into the performance of the contract, the Contractor shall provide the following disclosures in its offer:

Disclose the intended use of AI and provide a description of the AI system or capability and its purpose within the contract scope; specify whether the system was developed internally, acquired from a third party, or is publicly/commercially available; indicate if the AI system will process PII or be used in ways that may affect privacy, civil rights, safety, or public interaction; detail the governance, oversight, and human-in-the-loop mechanisms to be applied; and describe any applicable testing, evaluation, risk management, or bias mitigation measures that have been or will be implemented.

These disclosures must be updated promptly to the Contracting Officer during the period of performance upon any new use of AI or significant material change to the existing AI capability, its functionality, its use case, or its data inputs/outputs during the life of the contract.

The Government reserves the right to review the proposed AI use, request additional safeguards or controls, and/or disallow its use if it is deemed inconsistent with agency policy, legal requirements, or federal

AI governance standards.

(End of Clause)

All contractors must be registered in the SAM (System for Award Management) Database https://www.sam.gov, prior to submittal of their offer/quotations as prescribed under FAR 4.1102. Failure to be registered at time of offer/quotation submission may deem the offeror’s offer/quotation to be considered non‐responsible and no further https://www.sam.gov/ consideration will be given. Therefore, offerors are highly encouraged to register immediately if they are interested in submitting a response to this requirement.

Prospective offerors shall submit evidence of their SAM registration with the submittal of offer/quotation.

Offers are due by 3:00 PM, Friday Aug 21, 2026. All responsible sources may submit an offer that shall be considered. If there are any questions regarding this solicitation please contact Walter Williams, 6612-9287/317-

5119, fax 317-5141, email: williamswy@state.gov and pnmprocreq@state.gov .

Company Name Contractor Printed Name Signature Date mailto:williamswy@state.gov mailto:pnmprocreq@state.gov