RFQ no. 19TH2026Q0064 Software Licenses Subscriptions Renewal and Support Services.pdf

Embassy of the United States of America

Bangkok, Thailand

July 27, 2026

Dear Prospective Quoter:

Subject: Request for Quotations number 19TH2026Q0064

Enclosed is a Request for Quotations (RFQ) for software license subscriptions renewal and support services. If you would like to submit a quotation, follow the instructions in Section 3 of the solicitation, complete the required portions of the attached document, and submit it to the address shown on this letter.

The U.S. government intends to award a contract/purchase order to the responsible company submitting an acceptable offer at the lowest price. We intend to award a contract/purchase order based on initial quotations, without holding discussions, although we may hold discussions with companies in the competitive range if there is a need to do so.

Direct any questions regarding this solicitation in writing to Ramon Menendez-Carreira, Contracting Officer, email: BangkokGSOProcurement@state.gov. Questions must be written in English. Closing date for question submission will be July 30, 2026 at 12:00 PM (Bangkok local time).

Quotations are due by August 11, 2026 at 12:00 PM (Bangkok local time). No quotations will be accepted after this time. Proposals must be in English and incomplete proposals will not be accepted.

Your quotation must be submitted electronically to BangkokGSOProcurement@state.gov. It is important to make sure the submission is made in specific size and format; in Adobe Acrobat (pdf) file format. The file size must not exceed 25MB. If the file size should exceed 25MB, the submission must be made in separate files and attached to separate emails with less than 25MB each.

In order for a quotation to be considered, you must also complete and submit the following:

1. SF-1449

2. Section 1, Pricing

3. Section 5 Representations and Certifications

4. Additional information as required in Section 3

5. Proof of SAM Registration

6. CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) Questionnaire

Offerors shall be registered in the SAM (System for Award Management) database at https://www.sam.gov prior to submittal of their offer/proposal as prescribed under FAR 4.1102.

mailto:BangkokGSOProcurement@state.gov mailto:BangkokGSOProcurement@state.gov https://www.sam.gov/

Failure to be registered at time of proposal submission may deem the offeror’s proposal to be considered non-responsible and no further consideration will be given. Therefore, offerors are highly encouraged to register immediately if they are interested in submitting a response to this requirement.

Sincerely, Ramon Menendez-Carreira Contracting Officer

Enclosure:

Attachment 1 – Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30. 23

19TH2026Q0064

Ramon Menendez-Carreira 662-205-5320

U.S. Embassy Bangkok (See Attached)

1 Software Licenses Subscriptions Renewal and Support 1 LOT Services

(See Attached)

7/27/2026

8/11/2026

12:00 PM

U.S. Embassy Bangkok GSO/Procurement 120-122 Wireless Rd., Lumpini, Pathumwan, Bangkok, Thailand 10330

TABLE OF CONTENTS

SECTION 1 - THE SCHEDULE

• SF 1449 cover sheet

• Continuation To SF-1449, RFQ Number 19TH2026Q0064, Prices, Block 23

• Continuation To SF-1449, RFQ Number 19TH2026Q0064, Schedule Of

Supplies/Services, Block 20 Description/Specifications/Work Statement

SECTION 2 - CONTRACT CLAUSES

• Contract Clauses

• Addendum to Contract Clauses - FAR Clauses Prescribed in Part 12

• Addendum to Contract Clauses – FAR, DOSAR and Local Clauses not Prescribed in

Part 12

SECTION 3 - SOLICITATION PROVISIONS

• Solicitation Provisions

• Addendum to Solicitation Provisions - FAR Provisions Prescribed in Part 12

• Addendum to Solicitation Provisions - FAR and DOSAR Provisions not Prescribed in

Part 12

SECTION 4 - EVALUATION FACTORS

• Evaluation Factors

• Addendum to Evaluation Factors - FAR Provisions not Prescribed in Part 12

SECTION 5 - REPRESENTATIONS AND CERTIFICATIONS

• Offeror Representations and Certifications

SECTION 1 - THE SCHEDULE

CONTINUATION TO SF-1449

RFQ NUMBER 19TH2026Q0064

PRICES, BLOCK 23

I. SCOPE OF SERVICES

A. The Contractor shall deliver one-year software license subscriptions renewal and support services to U.S. Embassy Bangkok which are approved by the Government. The licenses and support services shall be activated by August 31, 2026, in accordance with the requirements, terms and conditions set forth herein.

B. This is a firm-fixed price type of purchase order.

C. The price listed below shall include all labor, materials, overhead, profit, and transportation necessary to deliver the required items to U.S. Embassy located in Bangkok, Thailand.

D. All prices are in Thai Baht.

E. Value Added Tax (VAT) is not applicable to this contract and shall not be included in the CLIN rates or invoices because the U.S. Embassy has a tax exemption certificate from the host government.

II. PRICING

Line Item Description Unit Unit Price Quantity Total Price

1-Year Software Licenses Subscriptions Renewal and Support Services LOT 1

Grand Total

CONTINUATION TO SF-1449,

RFQ NUMBER 19TH2026Q0064

SCHEDULE OF SUPPLIES/SERVICES, BLOCK 20

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

I. The Contractor shall deliver one-year Palo Alto subscriptions for URL filtering and Threat Prevention, Virtual Panorama to manage firewalls, partner enabled premium support renewal including advance spare part, remote and onsite support, and preventive maintenance for every four months within the contract period to U.S. Embassy Bangkok which are approved by the Government. The licenses and support services shall be activated by August 31, 2026. The Contractor must be an authorized distributor or partner with the Original Equipment Manufacturer (OEM) for the core products. The Contractor shall be able to provide on-site service locally in Bangkok, Thailand.

The subscriptions and services shall be compatible with existing systems and meet the following minimum specification requirements which are approved by the Government:

PART NUMBER ITEM DESCRIPTIONS QUANTITY

PAN-SOFTWARE-

NGFW-CR

Software NGFW Credits to deploy VM-Series, CN- Series, Subscription Services, and Virtual Panorama to manage Software Firewalls.

PAN-SVC-BKLN-

3220-R

Partner enabled premium support renewal, PA-3220

PAN-PA-3220-ATP-

HA2-R

Advanced Threat Prevention subscription for device in an HA pair renewal, PA-3220 2

PAN-PA-3220-

ADVURL-HA2-R

Advanced URL Filtering, 1-y ear, PA-3220, HA Pair Renewal 2

Unlimited telephone, instance messaging, remote incidence case support within the period of one (1) year for (24x7x4), 24 hours x 7 days per week x 4 hours of response time.

JOB

Onsite service within the period of one (1) year for (24x7x4), 24 hours x 7 days per week x 4 hours of response time.

JOB

Preventive maintenance at minimum of two (2) times within the period of one (1) year. JOB

Maximum of major firewall re-configuration of one

(1) time, and minor re-configuration or finetuning of four (4) times within the period of one (1) year.

JOB

The Contractor must complete the annual subscription renewal within August 31, 2026. The Contractor will be allowed to access the Government’s compound to complete the renewal during 08:00 – 17:00 hrs. from Monday to Friday (except the Government’s holiday). Working outside the specified schedule needs to be approved in advance by the Government. The contractor shall perform the services in a manner that does not interrupt the Government's operations or generate excessive noise. All deliverables must be coordinated and approved in advance by the Government. The Contractor is expected to assemble whatever possible offsite to reduce interruption at ILEA.

II. DELIVERY LOCATION AND TIME

A. The Contractor shall deliver all services to U.S. Embassy Bangkok. The address is:

International Law Enforcement Academy (ILEA) 88/8 Moo 3, Vibhavadi-Rangsit Road Talad Bangkhen, Laksi Bangkok 10210, Thailand

B. All license subscriptions and support services shall be activated by August 31, 2026.

C. Any Contractor personnel involved with the delivery of services shall comply with standard U.S. Embassy regulations for receiving services. The Contracting Officer Representative (COR) will be responsible for instructing contractor personnel at the time the services are delivered.

D. If services will be provided at the U.S. Embassy, the services shall be provided between the hours of 8:00 AM – 11:30 AM or 1:00 PM – 5:00 PM (Bangkok local time) from Monday to Friday except the Government’s holidays. For on-site services, below information shall be sent to SmitB@ileabangkok.com prior to service date to schedule the service:

1) Name – Surname of driver and passengers in English which match with the national identification card or passport.

2) Driver’s cellphone number

3) Service date and time

4) Purchase order

5) Vehicle’s information

a. Vehicle type (e.g. pick-up truck, motorcycle)

b. Vehicle’s plate number

c. Vehicle make and model

d. Vehicle color

E. The Contractor must provide delivery completion documentation for service coverage delivered under this contract in Adobe Acrobat (pdf) format. At a minimum, the closeout documents must include:

1) Completed support contact details of the Contractor which includes but not limited to:

a. Helpdesk telephone number (local or toll-free)

b. Support email address

c. Escalation contact information

2) Proof of valid subscription renewal, and support activation

3) Subscription and support confirmation documents

4) Standard subscription and support services for a period of one (1) year from subscription activation date.

All supporting certification documents must remain valid throughout the contract period.

mailto:SmitB@ileabangkok.com

III. QUALITY ASSURANCE AND SURVEILLANCE PLAN (QASP)

This plan provides an effective method to promote satisfactory contractor performance. The QASP provides a method for the Contracting Officer's Representative (COR) to monitor Contractor performance, advise the Contractor of unsatisfactory performance, and notify the Contracting Officer of continued unsatisfactory performance. The Contractor, not the Government, is responsible for management and quality control to meet the terms of the contract.

The role of the Government is to monitor quality to ensure that contract standards are achieved.

Performance Objective Scope of Work

Paragraphs Performance Threshold

Services.

Performs all license subscriptions renewal and support services set forth in the scope of work.

I thru II

All required services are performed and no more than one

(1) customer complaint is received per month.

1. SURVEILLANCE. The COR will receive and document all complaints from Government personnel regarding the services provided. If appropriate, the COR will send the complaints to the Contractor for corrective action.

2. STANDARD. The performance standard is that the Government receives no more than one

(1) customer complaint per month. The COR shall notify the Contracting Officer of the complaints so that the Contracting Officer may take appropriate action to enforce the inspection clause (FAR 52.212.4, Terms and Conditions-Commercial Products and Commercial Services), if there is more than one (1) customer complaint received per month.

3. PROCEDURES.

(a) If any Government personnel observe unacceptable services, either incomplete work or required services not being performed they should immediately contact the COR.

(b) The COR will complete appropriate documentation to record the complaint.

(c) If the COR determines the complaint is invalid, the COR will advise the complainant. The COR will retain the annotated copy of the written complaint for his/her files.

(d) If the COR determines the complaint is valid, the COR will inform the Contractor and give the Contractor additional time to correct the defect, if additional time is available. The COR shall determine how much time is reasonable.

(e) The COR shall, as a minimum, orally notify the Contractor of any valid complaints.

(f) If the Contractor disagrees with the complaint after investigation of the site and challenges the validity of the complaint, the Contractor will notify the COR. The COR will review the matter to determine the validity of the complaint.

(g) The COR will consider complaints as resolved unless notified otherwise by the complainant.

(h) Repeat customer complaints are not permitted for any services. If a repeat customer complaint is received for the same deficiency during the service period, the COR https://www.acquisition.gov/far/52.212-4 will contact the Contracting Officer for appropriate action under the Inspection clause.

SECTION 2 - CONTRACT CLAUSES

52.212-4 TERMS AND CONDITIONS – COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JAN 2026) IS INCORPORATED BY

REFERENCE. (SEE SF-1449, BLOCK 27A)

None

ADDENDUM TO CONTRACT CLAUSES

FEDERAL ACQUISITION REGULATION (FAR) CLAUSES

PRESCRIBED IN PART 12

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. In addition, the full text of a clause may be accessed electronically at: Acquisition.gov this address is subject to change.

If the Federal Acquisition Regulation (FAR) is not available at the location indicated above, use the Department of State Acquisition website at e-CFR to see the links to the FAR. You may also use an Internet “search engine” (for example, Google, Yahoo or Excite) to obtain the latest location of the most current FAR.

THE FOLLOWING FEDERAL ACQUISITION REGULATIONS (FAR) CLAUSES ARE

INCORPORATED BY REFERENCE:

CLAUSE TITLE AND DATE

52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS (NOV 2023)

52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY

AGREEMENTS OR STATEMENTS (JAN 2017)

52.204-13 SYSTEM FOR AWARD MANAGEMENT—MAINTENANCE

(JAN 2026)

52.209-6 PROTECTING THE GOVERNMENT'S INTEREST WHEN

SUBCONTRACTING WITH CONTRACTORS DEBARRED, SUSPENDED,

PROPOSED FOR DEBARMENT, OR VOLUNTARILY EXCLUDED (JAN

2026)

52.209-10 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC

CORPORATIONS (JAN 2026)

52.222-19 CHILD LABOR-COOPERATION WITH AUTHORITIES AND REMEDIES

(FEB 2026)

52.222-50 COMBATING TRAFFICKING IN PERSONS (FEB 2026)

52.226-8 ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT MESSAGING

WHILE DRIVING (MAY 2024)

https://acquisition.gov/browse/index/far https://gov.ecfr.io/cgi-bin/text-idx?SID=d9a7851186785ba2b1896db79b1b6b29&mc=true&tpl=/ecfrbrowse/Title48/48tab_02.tpl

52.232-33 PAYMENT BY ELECTRONIC FUNDS TRANSFER-SYSTEM FOR AWARD

MANAGEMENT (OCT 2018)

52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS

SUBCONTRACTORS (MAR 2023)

52.233-3 PROTEST AFTER AWARD (JAN 2026)

52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (JAN 2026)

52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (JAN 2026)

52.240-93 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION

SYSTEMS (JAN 2026)

52.244-6 SUBCONTRACTS FOR COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (JAN 2026)

ADDENDUM TO CONTRACT CLAUSES

FAR AND DOSAR CLAUSES NOT PRESCRIBED IN PART 12

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. In addition, the full text of a clause may be accessed electronically at: Acquisition.gov this address is subject to change.

If the Federal Acquisition Regulation (FAR) is not available at the location indicated above, use the Department of State Acquisition website at e-CFR to see the links to the FAR. You may also use an Internet “search engine” (for example, Google, Yahoo or Excite) to obtain the latest location of the most current FAR.

THE FOLLOWING FEDERAL ACQUISITION REGULATIONS (FAR) CLAUSES ARE

INCORPORATED BY REFERENCE:

CLAUSE TITLE AND DATE

52.225-14 INCONSISTENCY BETWEEN ENGLISH VERSION AND TRANSLATION OF

CONTRACT (FEB 2000)

52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUNE 2013)

THE FOLLOWING DOSAR CLAUSES ARE PROVIDED IN FULL TEXT:

CONTRACTOR IDENTIFICATION (JULY 2008)

Contract performance may require contractor personnel to attend meetings with government personnel and the public, work within government offices, and/or utilize government email.

Contractor personnel must take the following actions to identify themselves as non-federal employees:

https://gov.ecfr.io/cgi-bin/text-idx?SID=d9a7851186785ba2b1896db79b1b6b29&mc=true&tpl=/ecfrbrowse/Title48/48tab_02.tpl

1) Use an email signature block that shows name, the office being supported and company affiliation (e.g. “John Smith, Office of Human Resources, ACME Corporation Support Contractor”);

2) Clearly identify themselves and their contractor affiliation in meetings;

3) Identify their contractor affiliation in Departmental e-mail and phone listings whenever contractor personnel are included in those listings; and

4) Contractor personnel may not utilize Department of State logos or indicia on business cards.

(End of clause)

652.215-70 EXAMINATION OF RECORDS

(a) With respect to matters related to this contract or a subcontract hereunder, the Department of State Office of the Inspector General, or an authorized representative, shall have upon request:

(1) Complete, prompt, and free access to all Contractor and Subcontractor files (in any format), documents, records, data, premises, and employees, except as limited by law; and

(2) The right to interview any current Contractor and Subcontractor personnel, individually and directly, with respect to such matters.

(b) This clause may not be construed to require the contractor or any subcontractor to create or maintain any record that the contractor or subcontractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(c) The Contractor shall insert a clause containing all the terms of this clause, including this paragraph (c), in all subcontracts under this contract other than acquisitions described in Federal Acquisition Regulation 15.209(b)(1).

652.229-70 EXCISE TAX EXEMPTION STATEMENT FOR CONTRACTORS WITHIN

THE UNITED STATES (JUL 1988)

This is to certify that the item(s) covered by this contract is/are for export solely for the use of the U.S. Foreign Service Post identified in the contract schedule.

The Contractor shall use a photocopy of this contract as evidence of intent to export. Final proof of exportation may be obtained from the agent handling the shipment. Such proof shall be accepted in lieu of payment of excise tax.

652.232-70 PAYMENT SCHEDULE AND INVOICE SUBMISSION (FIXED-PRICE)

(AUG 1999)

(a) General. The Government shall pay the Contractor as full compensation for all work required, performed, and accepted under this contract the firm fixed-price stated in this contract.

(b) Invoice Submission. The Contractor shall submit invoices in an original to the ILEA Bangkok during the delivery. To constitute a proper invoice, the invoice shall include all the items required by FAR 32.905(e). The invoice shall be issued by using following address:

https://www.ecfr.gov/current/title-48/section-652.215-70#p-652.215-70(c)

U.S. Embassy Bangkok

ATTN: FMO

120-122 Wireless Road, Lumpini, Pathumwan, Bangkok 10330

The payment shall be made within 30 days after receiving services and proper invoices. The payment shall be made by Electronic Fund Transfer (EFT)

(c) Contractor Remittance Address. The Government will make payment to the contractor’s address stated on the cover page of this contract, unless a separate remittance address is shown below:

652.242-70 CONTRACTING OFFICER'S REPRESENTATIVE (COR) AUG 1999)

(a) The Contracting Officer may designate in writing one or more Government employees, by name or position title, to take action for the Contracting Officer under this contract. Each designee shall be identified as a Contracting Officer’s Representative (COR).

Such designation(s) shall specify the scope and limitations of the authority so delegated;

provided, that the designee shall not change the terms or conditions of the contract, unless the COR is a warranted Contracting Officer and this authority is delegated in the designation.

(b) The COR for this contract is ILEA Chief of Information Technology.

652.242-73 AUTHORIZATION AND PERFORMANCE (AUG 1999)

(a) The Contractor warrants the following:

(1) That is has obtained authorization to operate and do business in the country or countries in which this contract will be performed;

(2) That is has obtained all necessary licenses and permits required to perform this contract; and,

(3) That it shall comply fully with all laws, decrees, labor standards, and regulations of said country or countries during the performance of this contract.

(b) If the party actually performing the work will be a subcontractor or joint venture partner, then such subcontractor or joint venture partner agrees to the requirements of paragraph (a) of this clause.

652.243-70 NOTICES (AUG 1999)

Any notice or request relating to this contract given by either party to the other shall be in writing. Said notice or request shall be mailed or delivered by hand to the other party at the address provided in the schedule of the contract. All modifications to the contract must be made in writing by the Contracting Officer.

THE FOLLOWING LOCAL CLAUSE(S) IS/ARE PROVIDED IN FULL TEXT:

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT REQUIREMENTS (AUG 2024)

(a) Definitions. As used in this clause:

Covered article - The term "covered article" includes-

(1) "Information and Communications technology" which is an industry term for information technology that is involved in integrating telecommunications (e.g., telephone lines and wireless signals) and computers to enable users to access, store, manipulate, transmit, and receive digital information. This includes software, software as a service, digital and data services, and hardware components that support information creation, storage, transfer, and management, like computers and smartphones.

(2) "Telecommunications Equipment", which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

(3) "Telecommunications Service", which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

(4) “Cybersecurity Supply Chain Risk”, which means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

(5) “Incident,” which means, per the Federal Information Security Modernization Act of 2014, “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

(6) "Vulnerability,” means any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

(b) Contractor Cybersecurity Supply Chain Risk Management Responsibilities. The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

(c) Supporting Government Cybersecurity Supply Chain Risk Assessments. No more than an estimated once per year, the Contractor must provide any requested information related to its supply chain within 10 business days except information that is protected by a non-disclosure agreement with its customers (e.g., another federal agency).

(d) Novation Agreement Notice. FAR 42.1203 require Government approval of novation agreements. For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

(e) Notification procedures for cybersecurity supply chain incidents. When an incident occurs, the Contractor must contact the CO or their designee within 72 hours of the incident.

(f) Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

(g) Attestation following Major Version Change. For software provided under the contract that required an approved Secure Software Development Attestation Form, the responses on this form apply to the software’s major version changes (e.g., using a semantic versioning schema of Major, Minor, Patch, the software version number goes from 2.5 to 3.0) unless the Contractor otherwise notifies the Contracting Officer that the form is no longer valid. This notification to the Contracting Officer must be submitted within 15 days of the major version change and must include a new completed and signed Secure Software Development Attestation Form.

(end of clause)

SECTION 3 - SOLICITATION PROVISIONS

52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JAN 2026) IS INCORPORATED BY REFERENCE

(SEE SF-1449, BLOCK 27A)

ADDENDUM TO 52.212-1

A. Summary of Instructions. Each offer must consist of the following:

A.1. A completed solicitation, in which the SF-1449 cover page (blocks 12, 17, 19-24, and 30 as appropriate), and Section 1 and 5 has been filled out.

A.2. Cybersecurity Supply Chain Risk Management (C-SCRM) Form

The offeror shall include in its offer Attachment 1, C-SCRM Questionnaire. In lieu of a completed C-SCRM Questionnaire, the vendor may submit a third party authorizing official conducted assessment, such as ISO 27001, ISO 9000, SOC II, or FEDRAMP authorization.

The document must be completed in accordance with the attachment’s instructions. Failure to follow the attachment’s instructions may result in rejection of the offer.

A.3. Information demonstrating the offeror’s/quoter’s ability to perform, including:

(1) Name of a Project Manager (or other liaison to the U.S. Embassy/Consulate) who understands written and spoken English.

(2) Evidence that the offeror/quoter operates an established business with a permanent address in Thailand which includes but not limited to company’s registration document, company’s VAT registration document (Por Por 20). The offeror/quoter must also provide the company’s address and telephone listing in Thailand.

(3) The offeror/quoter shall provide proof of SAM registration which is downloaded from SAM.gov website to include the SAM UEI number and registration status. Written UEI number in the quotation with no SAM registration evidence downloaded from SAM.gov website is not acceptable.

(4) List of clients over the past five (5) years, demonstrating prior experience in the information technology solution in Thailand and references (provide dates of contracts, places of performance, value of contracts, contact names, telephone numbers and email addresses). In addition, the client’s contact person may be asked to comment on the offeror’s:

• Quality of services provided under the contract;

• Compliance with contract terms and conditions;

• Effectiveness of management;

• Willingness to cooperate with and assist the customer in routine matters, and when confronted by unexpected difficulties; and

• Business integrity / business conduct.

The Government will use past performance information primarily to assess an offeror’s capability to meet the solicitation performance requirements, including the relevance and successful performance of the offeror’s work experience. The Government may also use this data to evaluate the credibility of the offeror’s proposal. In addition, the Contracting Officer may use past performance information in making a determination of responsibility.

(5) Evidence that the offeror/quoter is an authorized distributor or partner with the Original Equipment for the core product(s).

(6) Evidence that the offeror/quoter is in the information technology solution business for no less than five (5) years.

(7) Evidence that the offeror/quoter has worked in deploying, configurating, or supporting enterprise networking or firewall solution before, and the value of that project must not be less than 100,000 USD.

(8) Evidence that the offeror/quoter can provide the necessary personnel, equipment, and financial resources needed to perform the work.

(13) Quotation which covers all services listed in the solicitation. The quotation shall consist of descriptions, product part number, quantities, unit prices, service coverage, delivery method and delivery lead time.

ADDENDUM TO SOLICITATION PROVISIONS

FAR PROVISIONS PRESCRIBED IN PART 12

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. In addition, the full text of a clause may be accessed electronically at Acquisition.gov this address is subject to change.

If the Federal Acquisition Regulation (FAR) is not available at the location indicated above, use the Department of State Acquisition website at e-CFR to see the links to the FAR. You may also use an Internet “search engine” (for example, Google, Yahoo or Excite) to obtain the latest location of the most current FAR.

THE FOLLOWING FAR SOLICITATION PROVISIONS ARE INCORPORATED BY

REFERENCE:

PROVISION TITLE AND DATE

52.203-18 PROHIBITION ON CONTRACTING WITH ENTITIES THAT REQUIRE

CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS OR

STATEMENTS-REPRESENTATION (JAN 2017)

52.204-7 SYSTEM FOR AWARD MANAGEMENT—REGISTRATION (JAN 2026)

52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JAN 2026)

ADDENDUM TO SOLICITATION PROVISIONS

FAR AND DOSAR PROVISIONS NOT PRESCRIBED IN PART 12

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. In addition, the full text of a clause may be accessed electronically at Acquisition.gov this address is subject to change.

If the Federal Acquisition Regulation (FAR) is not available at the location indicated above, use the Department of State Acquisition website at e-CFR to see the links to the FAR. You may also use an Internet “search engine” (for example, Google, Yahoo or Excite) to obtain the latest location of the most current FAR.

THE FOLLOWING FAR SOLICITATION PROVISIONS ARE INCORPORATED BY

REFERENCE:

PROVISION TITLE AND DATE

52.214-34 SUBMISSION OF OFFERS IN THE ENGLISH LANGUAGE (APR 1991)

https://gov.ecfr.io/cgi-bin/text-idx?SID=d9a7851186785ba2b1896db79b1b6b29&mc=true&tpl=/ecfrbrowse/Title48/48tab_02.tpl https://gov.ecfr.io/cgi-bin/text-idx?SID=d9a7851186785ba2b1896db79b1b6b29&mc=true&tpl=/ecfrbrowse/Title48/48tab_02.tpl

SECTION 4 - EVALUATION FACTORS

• Award will be made to the lowest priced, acceptable, responsible offeror. The quoter shall submit a completed solicitation, including Sections 1, 5 and attachment no. 1.

• The Government will perform an initial review of proposals/quotations received to determine completeness and compliance with the terms of the solicitation to include Cybersecurity Supply Chain Risk Management (C-SCRM) Go/No-Go Evaluation Factor. The Government may reject as unacceptable proposals/quotations that do not conform to the solicitation.

C-SCRM Go/No-Go Evaluation Factor This factor is evaluated on a go/no-go basis. The Government will evaluate whether the submitted C-SCRM Questionnaire and State Department Secure Software Development Attestation Form meet the definition for the “Go” or “No-Go” ratings for this factor. The “Go” and “No-Go” ratings and their definitions are as follows:

RATING

RATING DEFINITION

GO

The proposal meets the criteria in the following paragraph.

The C-SCRM Questionnaire contains both of the following: (1) C-SCRM Questionnaire instructions are completed; and (2) contains Yes answers for all questions in Sections 2 and 3 of the questionnaire; or the vendor has submitted a third party authorizing official conducted assessment such as, ISO 27001, ISO 9000, SOC II, or FEDRAMP authorization.

NO-GO

The proposal does not meet one (1) or more of the criteria in the following paragraph.

The C-SCRM Questionnaire contains both of the following: (1) C-SCRM Questionnaire instructions are completed; and (2) contains Yes answers for all questions in Sections 2 and 3 of the questionnaire; or the vendor has submitted a third party authorizing official conducted assessment such as, ISO 27001, ISO 9000, SOC II, or FEDRAMP authorization.

• The Government reserves the right to reject proposals that are unreasonably low or high in price.

• The lowest price will be determined by multiplying the offered prices times the quantities in

“Prices - Continuation of SF-1449, block 23”, and arriving at a grand total.

• The Government will determine acceptability by assessing the offeror's compliance with the terms of the RFQ to include the technical information required by Section 3.

• The Government will determine contractor responsibility by analyzing whether the apparent successful offeror complies with the requirements of FAR 9.1, including:

• Adequate financial resources or the ability to obtain them;

• Ability to comply with the required performance period, taking into consideration all existing commercial and governmental business commitments;

• Satisfactory record of integrity and business ethics;

• Necessary organization, experience, and skills or the ability to obtain them;

• Necessary equipment and facilities or the ability to obtain them; and

• Be otherwise qualified and eligible to receive an award under applicable laws and regulations.

ADDENDUM TO EVALUATION FACTORS

FAR PROVISION NOT PRESCRIBED IN PART 12

THE FOLLOWING FAR PROVISION IS PROVIDED IN FULL TEXT:

52.225-17 EVALUATION OF FOREIGN CURRENCY OFFERS (FEB 2000)

If the Government receives offers in more than one currency, the Government will evaluate offers by converting the foreign currency to United States currency using the exchange rate used by the Embassy in effect as follows:

(a) For acquisitions conducted using sealed bidding procedures, on the date of bid opening.

(b) For acquisitions conducted using negotiation procedures—

(1) On the date specified for receipt of offers, if award is based on initial offers; otherwise

(2) On the date specified for receipt of proposal revisions.

SECTION 5 - REPRESENTATIONS AND CERTIFICATIONS

52.240-90 SECURITY PROHIBITIONS AND EXCLUSIONS REPRESENTATIONS AND

CERTIFICATIONS (JAN 2026)

(a) Definitions. As used in this provision—

Backhaul, covered article, covered telecommunications equipment or services, critical technology, FASCSA order, Intelligence community, interconnection arrangements, national security system, roaming, sensitive compartmented information, sensitive compartmented information system, source, and substantial or essential component have the meanings provided in the clause 52.240- 91, Security Prohibitions and Exclusions.

Business operations means engaging in commerce in any form, including by acquiring, developing, maintaining, owning, selling, possessing, leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, or any other apparatus of business or commerce.

Marginalized populations of Sudan means—

(1) Adversely affected groups in regions authorized to receive assistance under section 8(c) of the Darfur Peace and Accountability Act (Pub. L. 109-344) (50 U.S.C. 1701 note); and

(2) Marginalized areas in Northern Sudan described in section 4(9) of such Act.

Restricted business operations means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110-174). Restricted business operations do not include business operations that the person (as that term is defined in Section 2 of the Sudan Accountability and Divestment Act of 2007) conducting the business can demonstrate—

(1) Are conducted under contract directly and exclusively with the regional government of southern Sudan;

(2) Are conducted under specific authorization from the Office of Foreign Assets Control in the Department of the Treasury, or are expressly exempted under Federal law from the requirement to be conducted under such authorization;

(3) Consist of providing goods or services to marginalized populations of Sudan;

(4) Consist of providing goods or services to an internationally recognized peacekeeping force or humanitarian organization;

(5) Consist of providing goods or services that are used only to promote health or education; or

(6) Have been voluntarily suspended.

Sensitive technology—

(1) Means hardware, software, telecommunications equipment, or any other technology that is to be used specifically—

(i) To restrict the free flow of unbiased information in Iran; or

(ii) To disrupt, monitor, or otherwise restrict speech of the people of Iran; and

(2) Does not include information or informational materials the export of which the President does not have the authority to regulate or prohibit pursuant to section 203(b)(3) of the International Emergency Economic Powers Act (50 U.S.C. 1702(b)(3)).

(b) Procedures.

(1) Covered telecommunications and video surveillance. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities excluded from receiving federal awards for “covered telecommunications equipment or services.”

(2) FASCSA Orders.

(i) The Offeror shall search in SAM for the phrase “FASCSA order” for any covered article, or any products or services produced or provided by a source, if there is an applicable FASCSA order described in paragraph (e) of FAR 52.240-91, Security Prohibitions and Exclusions.

(ii) The Offeror shall review the solicitation for any FASCSA orders that are not in SAM but are effective and apply to the solicitation and resultant contract (see FAR 40.204-1(c)(2)).

(iii) FASCSA orders issued after the date of solicitation do not apply unless added by an amendment to the solicitation.

(c) Covered telecommunications equipment or services representations. By submission of its offer, the Offeror represents that, after conducting a reasonable inquiry (that looks at any information in the Offeror’s possession but does not need to include an internal or third-party audit)—

(1) It will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation, except as waived by the solicitation, or as disclosed in paragraph (g); and

(2) It does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services, except as waived by the solicitation, or as disclosed in paragraph (g).

(d) FASCSA Representation. By submission of this offer, the offeror represents that it has conducted a reasonable inquiry, and that the offeror does not propose to provide or use in response to this solicitation any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA order in effect on the date the solicitation was issued, except as waived by the solicitation, or as disclosed in paragraph (g). A reasonable inquiry will look at any information in the offeror’s possession but does not need to include an internal or third-party audit.

(e) Sudan certification. By submission of its offer, the offeror certifies, after conducting a reasonable inquiry (that looks at any information in the offeror’s possession but does not need to include an internal or third-party audit), that the offeror does not conduct any restricted business operations in Sudan.

(f) Iran Representation and Certifications.

https://www.sam.gov/

(1) Except as provided in paragraph (f)(2) of this provision or if a waiver has been granted in accordance with FAR 40.203-3, the offeror, after conducting a reasonable inquiry (that looks at any information in the offeror’s possession but does not need to include an internal or third-party audit), by submission of its offer—

(i) Represents, to the best of its knowledge and belief, that the offeror does not export any sensitive technology to the government of Iran or any entities or individuals owned or controlled by, or acting on behalf or at the direction of, the government of Iran;

(ii) Certifies that the offeror, or any person (as defined at section 15 of the Iran Sanctions Act of 1996, Pub. L. 104-172, 50 U.S.C. 1701 note) owned or controlled by the offeror, does not engage in any activities for which sanctions may be imposed under section 5 of the Act. These sanctioned activities are in the areas of development of the petroleum resources of Iran, production of refined petroleum products in Iran, sale and provision of refined petroleum products to Iran, and contributing to Iran’s ability to acquire or develop certain weapons or technologies; and

(iii) Certifies that the offeror, and any person owned or controlled by the offeror, does not knowingly engage in any transaction that exceeds $15,000 with Iran’s Revolutionary Guard Corps or any of its officials, agents, or affiliates, the property and interests in property of which are blocked pursuant to the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.)

(see OFAC’s Specially Designated Nationals and Blocked Persons List at https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx)

(2) Exception for trade agreements. The representation and certification requirements of paragraph (f)(1) of this provision do not apply if—

(i) This solicitation includes a trade agreements notice or certification (e.g., 52.225-6, Trade Agreements Certificate); and

(ii) The offeror has certified that all the offered products to be supplied are designated country end products or designated country construction material.

(iii) The offeror shall email questions concerning sensitive technology to the Department of State at CISADA106@state.gov.

(g) Disclosure.

(1) If the Offeror is not able to represent compliance with the prohibitions in paragraphs (c) or (d), then the Offeror shall disclose within 72 hours to the contracting office identified in paragraph (g)(2) the following information for each product or service not compliant:

(i) Contract number and order number, if applicable;

(ii) Identification of whether this disclosure relates to paragraph (c) on covered telecommunication equipment or services, or to paragraph (d) on FASCSA orders;

(iii) A description of the products or services that the Contractor identifies or has reason to suspect is prohibited (include brand; model number, such as the original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable);

(iv) The entity that produced the product or service (include entity name, unique entity identifier, Contractor and Government Entity (CAGE) code, facilities responsible for design, fabrication, assembly, packaging, and test of the product, and whether the entity was the OEM or a distributor (provide manufacturer codes and distributor codes used for the product));

https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx mailto:CISADA106@state.gov

(v) Description of the functionality of the product or service and how that functionality impacts the risk to the product or service;

(vi) An explanation of any factors relevant to determining if the product or service should be permitted by an applicable exception, exemption, or waiver (if the offeror would like the Government to consider a waiver);

(vii) Whether alternative products or services are available that would be compliant with the prohibition;

(viii) If the product or service is related to item maintenance, include the following information on the item being maintained:

(A) Brand;

(B) Model number, OEM number, manufacturer part number, or wholesaler number; and

(C) Item description, as applicable.

(ix) Any readily available information about mitigation actions undertaken or recommended.

(2) If a disclosure is required to be submitted to a contracting office, the offeror shall submit the disclosure as follows:

(i) If a Department of Defense contracting office, the offeror shall submit the disclosure to the website at https://dibnet.dod.mil.

(ii) For all other contracting offices, the Offeror shall submit the disclosure to the Contracting Officer.

(3) If the disclosure provided does not contain any of the information required by paragraph (1), and the Offeror later discovers new information that is required by paragraph (1), then the Offeror shall submit a subsequent disclosure within 72 hours of discovering the new information.

(h) Executive agency review of disclosures. The Contracting Officer will review disclosures provided in paragraph (g) to determine if any applicable waiver may be sought. The Contracting Officer may choose not to pursue a waiver and may instead make an award to an Offeror that does not require a waiver.

(End of provision) https://dibnet.dod.mil/