A1 - Performance Work Statement GEMS_final.pdf

AMERICAN BATTLE MONUMENTS COMMISSION (ABMC)

Performance Work Statement

For

Global Enterprise Mobile Phone Services (GEMS)

May 12, 2026

Contents About ABMC

Overview

Contract Line Item Numbers (CLINs)

CLIN 0001–4001: PLAN A – Voice and SMS/MMS

CLIN 0002–4002: PLAN B – Voice, Data, and SMS/MMS

CLIN 0003–4003: PLAN C – Voice, Data, SMS/MMS, and Tethering

CLIN 0004–4004: PLAN D – Data Only

CLIN 0005–4005: Temporary Additional Services

Requirements Applicable to All CLINs

Emergency Calling

Period of Performance

General Information

Service Level Agreement (SLA) and Service Credits

Global Roaming and Travel Assurance

Business Continuity and Disaster Recovery

Executive and Mission-Critical Line Classification

Data Governance and Privacy

Device Security and MDM Integration

Cost Control and Optimization Governance

Innovation and Technology Roadmap

Subcontractor and Carrier Transparency

Escalation and Executive Governance

Value Added Tax (VAT)

Invoicing

ABMC Furnished Equipment

Addition of New Lines

Use, Data Protection, and Disclosure

Technology Refresh and Changes

Ordering, Training, and Customer Support

End of Contract and Transition-Out

Quality Assurance and Surveillance (QASP)

Contractor Selection and Location Assignments

Non-Award of Locations

Appendix A – Estimated Breakdown of Lines per Site

Appendix B – Cybersecurity Supply Chain Risk Management (C-SCRM) Requirements

About ABMC

American Battle Monuments Commission (ABMC) is an independent agency of the United States

Government established to commemorate the service and sacrifice of United States Armed Forces by operating and maintaining permanent American military cemeteries and memorials located outside the United States, as well as a limited number of locations within the United States.

ABMC manages 26 cemeteries and 31 memorials, monuments and markers across 17 countries, including France, Belgium, Italy, the United Kingdom, the Philippines, Tunisia, Panama, and

Mexico, as well as the United States. ABMC headquarters is in Arlington, Virginia, with key operational offices in Paris, France, and Manila, Philippines.

The agency’s mission requires reliable, secure, and globally accessible communications to support daily operations, visitor services, ceremonial events, and executive travel. ABMC’s Office of the

Chief Information Officer provides centralized information technology and communications services to all locations worldwide, enabling consistent operations across its distributed international footprint.

Overview

This Performance Work Statement (PWS) establishes the requirements for Global Enterprise

Mobile Phone Services (GEMS) in support of ABMC’s worldwide operations. Contractor shall provide enterprise mobile voice, data, and messaging services for ABMC personnel at the locations listed in Appendix A.

ABMC expects approximately two hundred (200) mobile lines across the service plans

(CLINs 0001–0004), but quantities are not finalized at the time of solicitation. Contractors shall propose pricing based on the estimated line counts in Appendix A and the ranges provided in the pricing schedule.

Final quantities by plan and total line counts will be established after contract award and may be adjusted during the period of performance based on operational needs. ABMC guarantees a minimum purchase of $8,000.00 under this contract. Beyond this minimum, quantities are not guaranteed. ABMC reserves the right to increase or decrease quantities within the scope of the contract.

The solution shall include subscription-based service plans, always-on global roaming, SIM/eSIM support, multi-carrier access for redundancy (where applicable), a secure management portal, detailed billing and usage reporting, and support for ABMC-furnished devices integrated with existing mobile device management capabilities.

Contractor shall provide all labor, materials, insurance, overhead, profit, and other resources necessary to perform the required services. ABMC will pay monthly for satisfactorily performed standard services. In addition to the standard service plans under CLINs 0001 through 0004, CLIN

0005 covers temporary additional services for approved roaming voice and data usage not included in the standard plans. These charges shall be billed in accordance with Contractor’s discounted rates in the pricing schedule and shall be invoiced only when authorized by the Contracting Officer.

This PWS establishes performance requirements, deliverables, and oversight mechanisms to support reliable service, cost control, transition from the incumbent provider, and ongoing operational continuity throughout the period of performance.

Contract Line Item Numbers (CLINs)

The CLINs are organized by service plan type to align pricing and performance with ABMC’s operational needs. They cover five subscription plans/categories: 1) voice and messaging only, 2) standard voice/data, 3) premium voice/data with tethering, 4) data-only service, 5) plus a separate

CLIN for approved temporary additional services such as roaming or overage charges not included in the standard plans.

Each CLIN includes the services, technical requirements, service levels, management functions, and recurring deliverables needed to support that plan during the base year and each option year.

Transition, number portability, portal access, SLA monitoring, compliance reporting, optimization, and related support are included within the applicable service CLINs and shall not be separately priced unless expressly stated.

• CLIN 0001–4001: Voice and SMS/MMS

Provides voice-only mobile services with SMS/MMS for users with basic communication needs. Includes unlimited calling and messaging with global roaming and enterprise management capabilities.

• CLIN 0002–4002: Voice, Data, and SMS/MMS

Provides standard mobile services with voice, messaging, and high-capacity data for routine business operations. Must include unlimited calling and messaging with global roaming and enterprise management capabilities, multi-carrier connectivity, and centralized management with performance monitoring.

• CLIN 0003–4003: Voice, Data, SMS/MMS, and Tethering

Provides premium mobile services with voice, messaging, high-capacity data and tethering for executive and high-demand users. Must include unlimited calling and messaging with global roaming and enterprise management capabilities, priority support, enhanced performance, and pooled data capabilities for frequent international travel.

• CLIN 0004–4004: Data Only

Provides data-only mobile services for tablets and broadband devices requiring reliable internet connectivity. Supports high-speed data, global roaming, and centralized usage and cost management.

• CLIN 0005–4005: Temporary Additional Services

Provides approved voice and data services not included in standard plans, such as excess roaming or special usage. Charges are applied on an as-needed basis using pre-negotiated discounted rates and are subject to a not-to-exceed ceiling of $100,000 USD for the base year.

During each option year, the not-to-exceed ceiling may be adjusted upward by up to 10% to account for economic inflation, subject to the Contracting Officer’s written approval.

Offerors shall price each CLIN for the base year and each option year in accordance with the pricing schedule. The CLIN price shall include all labor, materials, management, reporting, and other resources required to perform that CLIN.

CLIN 0001–4001: PLAN A – Voice and SMS/MMS

Contractor shall provide voice & messaging and SMS/MMS mobile services for ABMC personnel requiring basic communications at the locations assigned under this contract, as listed in Appendix

A. Services shall ensure reliable global connectivity, consistent performance, and integration with

ABMC management and billing processes.

Contractor shall:

1. Provide unlimited domestic and international voice and SMS/MMS

2. Enable Wi-Fi calling at no additional cost

3. Provide voicemail in English and applicable local languages

4. Provide always-on global roaming with seamless network transition and no SIM swap

5. Provide SIM/eSIM provisioning and lifecycle support

6. Maintain clear, uninterrupted service with minimum 98% network availability per country

7. Provide multi-carrier access with primary and secondary failover where available and legally permitted in the country of service

8. Automatically select the strongest available carrier

Deliverables (see Project Deliverables under “Requirements Applicable to All CLINs”)

CLIN 0002–4002: PLAN B – Voice, Data, and SMS/MMS

Contractor shall provide enterprise mobile voice, messaging, and data services for ABMC personnel requiring reliable connectivity for daily operations at the locations assigned under this contract, as listed in Appendix A. Services shall support routine communications, travel, and remote work with centralized management, predictable billing, and performance-based oversight.

Contractor shall:

1. Provide unlimited domestic and international voice and SMS/MMS

2. Provide 4G/5G data with a minimum 50GB high-speed allowance in US/EU/UK regions

3. Provide a minimum of 20GB high-speed roaming data

4. Ensure no per-MB roaming billing and maintain data speeds ≥10 Mb/s (no throttling below threshold)

5. Enable Wi-Fi calling at no additional cost.

6. Provide voicemail in English and applicable local languages

7. Provide always-on global roaming with seamless network transition and no SIM swap

8. Provide SIM/eSIM provisioning and lifecycle support

9. Maintain high-quality, uninterrupted service with minimum 98% availability per country

10. Provide multi-carrier access with primary and secondary failover where available and legally permitted in the country of service

11. Automatically select the strongest available carrier

12. Immediately remediate outages and notify the COR with root cause and corrective action

13. Support ABMC devices and ensure compatibility with Microsoft Intune, encryption, and remote wipe

Deliverables (see Project Deliverables under “Requirements Applicable to All CLINs”)

CLIN 0003–4003: PLAN C – Voice, Data, SMS/MMS, and Tethering

Contractor shall provide premium mobile voice, messaging, data, and tethering services for ABMC personnel requiring high-capacity connectivity and priority support during domestic and international operations. This CLIN supports executive leadership, Office of the Chief Information

Officer (OCIO), public affairs, and other high-demand users.

Contractor shall:

1. Provide unlimited domestic and international voice and SMS/MMS

2. Provide 4G/5G data with a minimum 50GB high-speed allowance in US/EU/UK regions

3. Enable tethering for mobile hotspot use

4. Provide a minimum of 20GB high-speed roaming data

5. Ensure no per-MB roaming billing and maintain data speeds ≥10 Mb/s

6. Support pooled global data for frequent international travelers, where applicable

7. Enable Wi-Fi calling and provide voicemail in English and applicable local languages

8. Provide always-on global roaming with seamless network transition and no SIM swap

9. Provide SIM/eSIM provisioning and lifecycle support

10. Maintain high-quality, uninterrupted service with minimum 98% availability per country

11. Provide multi-carrier access with primary and secondary failover where available and legally permitted in the country of service

12. Automatically select the strongest available carrier

13. Provide enhanced monitoring and priority handling for executive and mission-critical lines

14. Provide pre-travel validation support upon request

15. Immediately remediate outages and notify the COR with root cause and corrective action

16. Support ABMC devices and ensure compatibility with Microsoft Intune, encryption, and remote wipe

17. Comply with Section 889 and provide annual supply chain attestation

Deliverables (see Project Deliverables under “Requirements Applicable to All CLINs”)

CLIN 0004–4004: PLAN D – Data Only

Contractor shall provide data-only mobile services for ABMC tablets, mobile broadband devices, and other data-centric equipment at the locations assigned under this contract, as listed in

Appendix A. Services shall support reliable internet connectivity for field operations, executive use, and mobile work environments.

Contractor shall:

1. Provide 4G/5G data service with a minimum 50GB high-speed allowance in

US/EU/UK regions

2. Provide a minimum of 20GB high-speed roaming data

3. Ensure no per-MB roaming billing and maintain data speeds ≥10 Mb/s (no throttling below threshold)

4. Enable tethering where applicable

5. Provide always-on global roaming with seamless network transition

6. Provide SIM/eSIM provisioning and lifecycle support

7. Maintain reliable, continuous data service with minimum 98% availability per country

8. Provide multi-carrier access with primary and secondary failover where available and legally permitted in the country of service

9. Automatically select the strongest available carrier

10. Immediately remediate outages and notify the COR with root cause and corrective action

11. Support ABMC devices and ensure compatibility with Microsoft Intune and applicable security controls

12. Comply with Section 889 and provide annual supply chain attestation

Deliverables (see Project Deliverables under “Requirements Applicable to All CLINs”)

CLIN 0005–4005: Temporary Additional Services

Contractor shall provide temporary additional mobile telecommunications services on an as-needed basis when approved requirements fall outside the standard service plans under CLINs

0001 through 0004. These services are intended to cover unplanned or short-duration voice, data, roaming, or related mobile service needs that are not included in the monthly plan allowances.

Temporary additional services may include excess roaming voice or data usage, international usage outside included coverage areas, short-term service upgrades, or other approved communications charges necessary to support official ABMC business. All such services shall be provided only upon authorization by the Contracting Officer and shall be billed in accordance with the

Contractor’s discounted rates set forth in the pricing schedule.

• Contractor shall ensure that temporary additional services are transparent, auditable, and limited to actual approved usage. The total cumulative amount billed under this CLIN across the contract period shall not exceed $100,000 USD (not-to-exceed) for the base year. During each option year, the not-to-exceed ceiling may be adjusted upward by up to 10% to account for economic inflation, subject to the Contracting Officer’s written approval.

Contractor shall itemize all temporary additional services on the monthly invoice and provide supporting usage detail sufficient for ABMC to validate the charges.

Requirements Applicable to All CLINs

These requirements apply to CLINs 0001–0005 for the base and all option years and establish enterprise standards for service delivery, pricing, migration, performance, management, security, and reporting. All requirements shall be included in CLIN pricing unless otherwise specified.

Contractor shall provide enterprise-wide service management, including provisioning, migration, performance monitoring, billing transparency, security compliance, and continuous optimization.

Contractor shall:

1. Immediately remediate outages and notify the Contracting Officer’s Representative

(COR)

2. Provide services at fixed base-year rates; option year pricing shall be pre-priced and not exceed proposed rates. Quantities are estimates and may be required at multiple locations.

3. Provide SIM/eSIM provisioning and lifecycle support

4. Retain and migrate all existing ABMC numbers. Provide new numbers as requested as part of normal line provisioning; any recurring carrier charges or country-specific numbering fees shall be priced in accordance with the contract rates.

5. Submit a migration schedule within 10 business days of contract award and complete migration within 30 days of COR-approved migration schedule, unless otherwise agreed.

6. Provide live support during migration and coordinate with the COR

7. Perform pre-cutover signal testing at all major locations and obtain COR approval prior to migration

8. Provide always-on global roaming with no per-MB billing

9. Provide multi-carrier access with primary and secondary failover where available and legally permitted in the country of service.

10. Automatically select the strongest available carrier

11. Ensure continuous global connectivity and redundancy

12. Provide a secure 24/7 management portal with:

a. Role-based access and line lifecycle management

b. SIM/eSIM management and usage monitoring

c. Billing visibility and downloadable reports

d. Asset tracking (IMEI, IMEI2, serial, assignment)

e. Analytics, cost optimization, and automated plan right-sizing

f. Dispute tracking and API integration

g. Use a FIPS 140-3 validated cryptographic module for authentication, where applicable

13. Maintain minimum 98% network availability per country and monitor performance, roaming, and billing accuracy

14. Propose and automatically apply agreed service credits for SLA failures.

15. Comply with Section 889 and provide annual supply chain attestation

16. Support ABMC devices and ensure compatibility with Microsoft Intune and security controls

17. Provide annual device lifecycle recommendations

18. Perform rate plan analysis within 30 days of activation and quarterly thereafter, benchmark pricing, and implement approved optimizations

Project Deliverables

1. Transition-In Project Plan (within 10 business days of contract award)

2. Migration Schedule (within 10 business days of contract award; weekly updates)

3. Coverage Validation Report (pre-cutover)

4. Post-Migration Validation Report

5. Monthly Summary Invoice

6. Monthly Detailed Billing Report

7. Monthly SLA Performance Report

8. Monthly Dispute and Credit Report

9. Quarterly Rate Optimization Report

10. Quarterly Executive Dashboard

11. Portal Configuration Documentation

12. Quarterly Asset Inventory Report

13. Annual Device Lifecycle Recommendation

14. Annual Section 889 Attestation

15. Cybersecurity supply chain incident notification (within 72 hours, per Appendix B)

16. Service Change Notification (within 15 days)

17. Ad hoc Coverage Analysis Report

18. Service Credit Calculation and Remediation Plan

All deliverables shall be submitted electronically to the COR. Failure to meet requirements may result in invoice rejection, service credits, or other contractual remedies.

Emergency Calling

Contractor shall support emergency calling for all voice-capable lines where legally and technically available. For U.S. lines, Contractor shall support E911, including dispatchable location information where supported, and shall identify any Wi-Fi calling or service limitations in advance.

For non-U.S. locations, Contractor shall support access to local emergency numbers and identify any country-specific limitations and/or required user actions. Contractor shall maintain procedures for updating service addresses and validating emergency call routing after migration or material service changes. Contractor shall notify the Contracting Officer and COR within one hour of any outage or defect that materially affects emergency calling.

Deliverables

1. Emergency Calling Plan within 10 business days after contract award

2. Country-by-country emergency calling matrix before cutover

3. Validation report after each migration wave

4. Updated U.S. emergency address records after adds, moves, or changes

5. Incident report within 24 hours of any emergency calling failure

Period of Performance

This contract shall be for one base year from the date of contract award, or as negotiated, with four

(4) one-year option periods.

General Information

Service Level Agreement (SLA) and Service Credits

Contractor shall meet defined SLAs for network availability, roaming performance, ticket response, and billing accuracy. Network availability shall be ≥98% per country per month. Priority incidents shall be acknowledged within one (1) hour and resolved within four (4) hours. Billing accuracy shall be ≥99.8%. Contractor shall apply agreed service credits for SLA failures to invoices. Contractor shall provide monthly SLA reports and participate in quarterly reviews.

Global Roaming and Travel Assurance

Contractor shall provide always-on global roaming for CLIN 0001-0004 services without manual activation. Contractor’s solution shall support eSIM and dual-carrier capability where feasible.

Contractor shall provide pre-travel validation for executive and mission-critical lines and notify the COR of abnormal roaming or connectivity issues.

Business Continuity and Disaster Recovery

Contractor shall maintain carrier redundancy and provide a Business Continuity Plan with failover and restoration procedures. Service restoration for major outages shall not exceed 24 hours.

Executive and Mission-Critical Line Classification

Contractor shall support priority designation for executive and mission-critical lines. Priority lines shall receive enhanced monitoring and expedited support. If the Contractor offers a device refresh or replacement option under this contract, Contractor shall make that option available for priority users and support rapid swap or loaner arrangements within one (1) business day where available.

Escalation shall occur immediately upon incident detection.

Data Governance and Privacy

Contractor shall encrypt ABMC data in transit and, where ABMC data is stored in Contractor-managed systems (such as portals and billing systems), encrypt that data at rest. Contractor shall not use ABMC data for secondary purposes. Data retention policies shall be documented and disclosed.

Device Security and MDM Integration

Devices shall support Microsoft Intune, conditional access, and remote wipe. Contractor shall ensure compatibility with current iOS versions and provide update timelines.

Cost Control and Optimization Governance

Contractor shall perform rate plan analysis within 30 days of activation and quarterly thereafter, provide optimization recommendations, and implement approved changes to reduce cost.

Innovation and Technology Roadmap

Contractor shall provide an annual briefing on network, roaming, and mobility advancements and recommend improvements to performance and cost efficiency.

Subcontractor and Carrier Transparency

Contractor shall disclose all underlying carriers by country and notify the Contracting Officer within 15 days of any material changes.

Escalation and Executive Governance

Contractor shall provide an escalation matrix with operational and executive contacts and conduct quarterly executive reviews of performance, coverage, and risk.

Value Added Tax (VAT)

The American Battle Monuments Commission (ABMC) is an independent agency under the

Executive Branch of the United States Government and is not subject to federal, state, or local taxes. All goods and services procured by this agency are for the exclusive use of the United States

Government. However, there are defined cases where VAT is paid as a cost of doing business when exemption cannot be enforced, with reimbursement pursued only above thresholds.

Invoicing

(a) Contractor shall submit monthly invoices to the ABMC. A proper invoice must include the following information:

1. Contractor’s name and payment instructions (may be provided at contract start and updated as needed)

2. Invoice Date

3. Contract number and delivery order number

4. A summary showing a listing of each line with total monthly price in local currency for that line and the USD equivalent. The exchange rate method shall be the method identified in the pricing schedule.

5. A separate line item for VAT, if applicable

6. A detailed list of all communications made for each line

7. Prompt payment discount, if any

8. Type of tariff or plan used

9. Name, title, phone number, and address of person to contact in case of defective invoice

(b) If an invoice does not contain the above information, ABMC reserves the right to reject the invoice as improper and return it to Contractor within 7 calendar days. Contractor must then submit a proper invoice.

(c) A proper invoice includes both the monthly summary invoice and the detailed billing information listed above. Contractor shall submit both jointly by email to OCIO@abmc.gov.

(d) Payment shall be made in USD by Electronic Funds Transfer (EFT) within 30 days after receipt of a correct and verified invoice.

ABMC Furnished Equipment

ABMC will use approximately 200 government-owned iPhones, iPads, and related devices.

Contractor shall provide SIM/eSIM, including PIN/PUK codes, for all lines. Devices shall support current EU/US 5G bands and future 5G SA and be compatible with Microsoft Intune and security policies.

Addition of New Lines

Contractor shall provision SIM/eSIM, phone numbers, and security codes within 24 hours of approved modifications. Contractor shall maintain a stock of approximately 60 SIM cards annually at locations designated by the COR, at no additional charge beyond the contract rates. Wi-Fi calling shall be enabled for all lines at no additional cost.

Use, Data Protection, and Disclosure

Services are for official ABMC use only. Contractor shall use ABMC information solely for contract performance and shall not disclose it except as required to perform the work.

Technology Refresh and Changes

ABMC may make changes within the scope of this contract to address technology updates or improve performance. Contractor shall provide ABMC an option to refresh or replace mobile devices during the contract period if ABMC elects to do so, including the ability to add, upgrade, or swap devices as needs change. Contractor shall support the integration and activation of replacement devices and any new or updated services when directed. Contractor shall provide an annual device lifecycle recommendation that includes a three-year refresh outlook.

Ordering, Training, and Customer Support

Services shall be ordered via delivery orders issued by the Contracting Officer. Contractor shall provide training to the COR on portal and management tools at no cost. Contractor shall provide centralized customer support for technical issues, billing, and service requests.

End of Contract and Transition-Out

Services terminate at contract end. Contractor shall maintain voicemail for 15 days to support transition and shall provide number portability and data export for up to 90 days after expiration at no additional cost.

Quality Assurance and Surveillance (QASP)

Contractor is responsible for service quality; ABMC monitors performance. Performance standards and service credits are defined in the “Service Level Agreement (SLA) and Service

Credits” section.

The COR will review performance monthly and may require corrective action. Repeated failures may result in service credits or other contractual remedies, consistent with the SLA section.

Contractor Selection and Location Assignments

ABMC will evaluate proposals based on technical capability, solution quality, cost, regulatory compliance, and past performance. ABMC prefers a single award covering all locations, but reserves the right to make one award, multiple awards by site or region, or no award for certain locations if that approach provides better value, reduces risk, or better supports mission requirements.

Site assignments may be based on geographic coverage, service availability, demonstrated capability, price, and compliance with applicable requirements. If ABMC awards multiple contracts, each awarded contractor shall perform all work and meet all requirements for the

Locations assigned under its contract.

Contractor shall:

- Remain fully responsible for all services and deliverables assigned by ABMC

- Perform in accordance with the PWS and all other contract terms

- Obtain prior written approval from ABMC before subcontracting or delegating assigned work

Non-Award of Locations

ABMC may exclude specific Locations from award if a proposal does not meet technical, operational, or regulatory requirements, or if agency priorities change before award. Any decision not to award certain Locations shall not affect the validity of awards made for other locations.

Appendix A – Estimated Breakdown of Lines per Site

Region/Location

Code Site Name Street Address & City

Number of Lines

Northern Europe FRANCE 106

Overseas Office

(OO)

Paris Office 32 rue de Monceau 53

BRAC Brittany American Cemetery Bel Orient, Montjoie Saint Martin 4

AMAC

Aisne-Marne American

Cemetery 1 Rue de Chevaliers de Colomb, Belleau 7

EPAC Epinal American Cemetery 385, rue de la Rondenolle, Dinozé 3

LOAC

Lorraine American

Cemetery Avenue de Fayetteville, St Avold 3

MAAC

Meuse-Argonne American

Cemetery Rue du Général Pershing 5

NOAC

Normandy American

Cemetery

Rue du Cimetière Américain, Colleville Sur

Mer

OAAC

Oise-Aisne American

Cemetery CD2, Seringes-et- Nesles 4

PDH

Pointe du Hoc Ranger

Monument (lines are under

NOAC)

Site de la Pointe Du Hoc

RHAC Rhone American Cemetery 553 blvd John F.

Kennedy, 83300 Draguignan

SMAC

Saint-Mihiel American

Cemetery Route de Verdun, Thiaucourt 5

SOAC Somme American Cemetery 02420 Bony 3

SUAC

Suresnes American

Cemetery 123 Boulevard Washington, Suresnes 6

CTAM

Château Thierry American

Cemetery (lines are under

AMAC)

Route du Monument, Château-Thierry

LEMC

Lafayette Escadrille Monument

Cemetery (lines are under

SUAC)

5 Boulevard Raymond Poincaré, Marnes-la-

Coquette

Northern

Europe Belgium 9

HCAC

Henri-Chapelle American

Cemetery 159, rue du Mémorial Américain, Hombourg 3

ARAC

Ardennes American

Cemetery 164, route du Condroz, Neupré 3

FFAC

Flanders-Fields American

Cemetery Wortegemseweg 117, Waregem 3

Mediterranean Italy 9

SRAC

Sicily Rome American

Cemetery Piazzale Kennedy, 1, 00048 Nettuno 5

FLAC

Florence American

Cemetery Via Cassia S.N., Tavarnuzze 4

Northern Europe Luxembourg 4

LXAC

Luxembourg American

Cemetery 50, Val du Scheid, Luxembourg 4

Northern Europe Netherlands 5

NEAC

Netherlands American

Cemetery AM Begraafplaats 1, NA Margraten 5

Pacific Philippines 19

MNAC Manila American Cemetery McKinley Road, Fort Bonifacio, Taguig City 15

CLAC Clark Veterans Cemetery Manuel A. Roxas Highway, Clark Freeport

Zone, Pampanga, Philippines

Northern Europe United Kingdom 7

CAAC

Cambridge American

Cemetery Madingley Road, Coton 4

BKAC

Brookwood American

Cemetery Dawney Hill - Brookwood, Woking 3

North Africa Tunisia 4

NAAC

North Africa American

Cemetery 553 rue Roosevelt, Carthage 2016, Tunisia 4

Central America Panama 4

CZAC Corozal American Cemetery Calle Rufina Alfaro, Edif. Corozal 4

Central America Mexico 2

MXAC

Mexico City US National

Cemetery

Virginia Fabregas No. 31, Col. San

Rafeal, C.P. 06470, Mexico, D.F, Mexico

City, Mexico

North America United States 31

HQ

Arlington Washington DC

Headquarters 2300 Clarendon Boulevard, Arlington, VA 31

Total Number of Estimated Lines: 200

The table above shows an estimation of the line breakdown per site.

Appendix B – Cybersecurity Supply Chain Risk Management (C-SCRM) Requirements

Covered articles include information and communications technology, telecommunications equipment, and telecommunications services used to create, store, transmit, or manage data.

Cybersecurity supply chain risk refers to the risk of compromise, disruption, or unauthorized manipulation of these systems or the data they process. An incident is any event that jeopardizes system integrity, confidentiality, or availability. A vulnerability is any weakness that can be exploited.

Contractor Responsibilities

Contractor shall identify, assess, monitor, and mitigate cybersecurity supply chain risks associated with all services and products provided. Contractor shall maintain documentation demonstrating compliance and provide such artifacts to ABMC within 48 hours of request, with proprietary information redacted as necessary.

Contractor shall support ABMC supply chain risk assessments by providing requested information within 10 business days, unless restricted by nondisclosure obligations. For any proposed novation, Contractor shall provide required information on the successor entity and its supply chain for ABMC approval.

Incident Reporting and Compliance

Contractor shall notify the Contracting Officer within 72 hours of any cybersecurity supply chain incident. Contractor shall flow down these requirements to all subcontractors supporting this contract.

For software requiring a Secure Software Development Attestation, Contractor shall ensure the attestation remains valid for major version changes. If no longer valid, Contractor shall notify the

Contracting Officer within 15 days and provide an updated attestation.