RFQ_CellPHone_25Q3006.pdf

TABLE OF CONTENTS

SECTION 1 - THE SCHEDULE

• SF 18 or SF 1449 cover sheet

• Continuation To SF-1449, RFQ Number 19TU1525Q3006, Prices, Block 23

• Continuation To SF-1449, RFQ Number 19TU1525Q3006, Schedule Of Supplies/Services, Block

20 Description/Specifications/Work Statement

• Attachment 1 to Description/Specifications/Performance Work Statement, Government Furnished

Property.

• Attachment 2 CERTIFICATION REGARDING COMPLIANCE WITH APPLICABLE

FEDERAL ANTI-DISCRIMINATION LAW.

• Attachment 3 CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

SOFTWARE PRODUCER ATTESTATION FORM.

SECTION 2 - CONTRACT CLAUSES

• Contract Clauses

• Addendum to Contract Clauses - FAR and DOSAR Clauses not Prescribed in Part 12

SECTION 3 - SOLICITATION PROVISIONS

• Solicitation Provisions

• Addendum to Solicitation Provisions - FAR and DOSAR Provisions not Prescribed in Part 12

SECTION 4 - EVALUATION

• Evaluation

• Addendum to Evaluation - FAR and DOSAR Provisions not Prescribed in Part 12

SECTION 5 - REPRESENTATIONS AND CERTIFICATIONS

• Representations and Certifications

• Addendum to Offeror Representations and Certifications - FAR and DOSAR Provisions not

Prescribed in Part 12

SOLICITATION FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER

PR15254031

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER

19TU1525Q3006

6. SOLICITATION ISSUE DATE

May 22nd, 2025

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME Sean T. Buckley, GSO or Procurement Specialist

b. TELEPHONE NUMBER(No collect calls)

+90-312-294 00 00

8. OFFER DUE DATE/ LOCAL

TIME

June. 23rd, 2025, 3:00 p.m.

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE:____ % FOR:

SMALL BUSINESS WOMEN-OWNED SMALL BUSINESS

General Services Office, U.S. Embassy of Ankara

HUBZONE SMALL

BUSINESS

(WOSB) ELLIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM NAICS:

Çukurmbar Mah. 1480 Sk. No 1, Çankaya, Ankara, Türkiye

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

EDWOSB

8 (A) SIZE STANDARD:

11. DELIVERY FOR FOB DESTINAT-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS 13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

U.S. Embassy of Ankara Service to All Approved Properties Çukurmbar Mah. 1480 Sk. No 1, Çankaya, Ankara, Türkiye

U.S. Embassy of Ankara Facility Maintenance Section Çukurmbar Mah. 1480 Sk. No 1, Çankaya, Ankara

17a CONTRACTOR CODE FACILITY

CODE

18a. PAYMENT WILL BE MADE BY U.S. Embassy of Ankara Financial Management Center Çukurmbar Mah. 1480 Sk. No 1, Çankaya, Ankara

CODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

All Items Cellular Phone Voice and Data Service Plan for the U.S. Mission in Türkiye to service Embassy Ankara, Consulate Istanbul, Izmir and Adana as detailed in Section 1. of the SOW here under.

12 months TRY TRY

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a.SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED

27b.CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN ____

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL

ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29. AWARD OF CONTRACT: REF. _________________ OFFER DATED

____________. YOUR OFFER ON SOLICITATION (BLOCK 5), INCLUDING ANY

ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN, IS ACCEPTED AS

TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print) Sean T. Buckley

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 1449 (REV. 02/2012)

PREVIOUS EDITION IS NOT USABLE Computer Generated Prescribed by GSA - FAR (48 CFR) 53.212

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: _______________________________

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

36. PAYMENT 37. CHECK NUMBER

PARTIAL FINAL

COMPLETE PARTIAL

FINAL

38. S/R ACCOUNT NO.

39. S/R VOUCHER NO. 40. PAID BY

41.a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print) 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41C. DATE

42b. RECEIVED AT (Location)

42c. DATE REC’D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

SECTION 1 - THE SCHEDULE

[MONTHLY SUBSCRIPTION PLAN]

CONTINUATION TO SF-1449

RFQ NUMBER 19TU1525Q3006

PRICES, BLOCK 23

1. SCOPE OF CONTRACT

The Contractor shall provide mobile telephone services to the U.S. Embassy in Ankara and the U.S.

Consulates in Istanbul, Adana, and Izmir. Prices shall include all labor, materials, insurance (per FAR 52.228-4 and 52.228-5), overhead, and profit.

Services will be delivered under a fixed monthly subscription per phone line, supporting approximately 1,300 lines. Required services include voice and SMS, bilingual voicemail (English and Turkish), mobile data, international calling, and roaming. The Contractor must ensure reliable service with nationwide coverage in Türkiye and strong international connectivity, especially in Europe and the United States. All service levels must meet the requirements outlined in the Performance Work Statement (PWS).

The contract includes a one (1) year base period, with two (2) additional one (1) year option periods. The Contractor shall provide technical support, account management, and usage monitoring. New line activation must be completed within 24 hours. Monthly billing per line is required, along with secure handling of Government information. The Government will compensate the Contractor monthly for services satisfactorily performed and accepted.

Award will be made as a firm-fixed-price contract to the responsible offeror whose quotation represents the best value to the Government, using a comparative evaluation method in accordance with FAR 13.106-2(b)(3). Offerors must meet the responsibility standards in FAR 9.104 and comply fully with solicitation terms. This procurement will be conducted under full and open competition in accordance with FAR Part 13. All responsible sources may submit a quotation for consideration.

II. PERIOD OF PERFORMANCE

The contract will include a one (1) year base period, with two (2) additional one (1) year option periods available for renewal.

III. PRICING

The contractor shall deliver the services required under this contract for the following firm fixed price and within the period specified. The rates below shall include all costs associated with the mobile telephone services in accordance with the requirements set forth in this solicitation document including materials, labor, insurance (see FAR 52.228-4 and 52.228-5), overhead and profit. All prices shall be in Turkish Liras (TL) and valid for 30 days.

VALUE ADDED TAX (VAT)

Value Added Tax (VAT) is not applicable to this contract and shall not be included in the CLIN rates or Invoices because the U.S. Embassy has a tax exemption certificate from the host government.

III.A BASE YEAR OF SERVICE

BASE YEAR: Monthly subscription plan — fixed rate per phone, billed monthly for approximately 1,300 lines, in accordance with the services specified in the line items below. (The base year of the contract will commence on the date indicated in the Task Order and will continue for a period of 12 months.)

# Description Minimum Technical

Requirement Per Subscription Plan

Estimated Yearly Quantity

Unit Price Per Month

(TL)

Total Yearly Price (Unit Price Per Month

X 12 Months) (TL)

1 Voice + SMS + Internet Package for Usage within Türkiye

1A Calls within Embassy "Mobile" Group 3000 mins/month

1300 Lines X 12 Months

1B Calls within Turkey 1200 mins/month

1C Internet Access 4.5G/5G in Country 20 Gb/month

1D SMS within the Country 1000 SMS/month

Total Package Price for Usage within Türkiye (1A+1B+1C+1D)

2 International Calls and SMS (From Türkiye to Other Countries)

2A To USA 120 mins/month 50 Call Packages X 12 Months = 600

2B To Europe 100 mins/month 50 Call Packages X 12 Months = 600

2C Other Countries outside of 3A 60 mins/month 20 Call Packages X 12 Months = 240

2D SMS to US, Europe and Other Countries 500 SMS/month 100 SMS/month 100 SMS Packages X

12 Months = 1200

Total Package Price for International Calls and SMS (2A+2B+2C+2D)

3 International Monthly Roaming Packages (Voice + Internet + SMS)

3A In USA and Europe 1000 min Voice + 1GB Data + 100 SMS

50 Roaming Packages X 12 Months = 600

3B Domestic Plan Benefits -My Service Plan Abroad- (price per day per subscription)

50 Roaming

3C In Countries Other Than in 3A 100 mins/month

20 Roaming

Months = 240

Total Package Price for International Roaming (3A+3B+3C)

4 Additional New Lines 100

∑ Base Year Annual Total for Standard Services (Total Prices of 1+2+3+4)

III.B FIRST OPTION YEAR OF SERVICE

FIRST OPTION YEAR: Monthly subscription plan — fixed rate per phone, billed monthly for approximately 1,300 lines, in accordance with the services specified in the line items below. (The first option year of the contract will commence on the date indicated in the Task Order and will continue for a period of 12 months.)

# Description Minimum Technical

Requirement Per Subscription Plan

Estimated Yearly Quantity

Unit Price Per Month

(TL)

Total Yearly Price (Unit Price Per Month

X 12 Months) (TL)

1 Voice + SMS + Internet Package for Usage within Türkiye

1A Calls within Embassy "Mobile" Group 3000 mins/month

Country 20 Gb/month

1D SMS within the Country 1000 SMS/month

Total Package Price for Usage within Türkiye (1A+1B+1C+1D)

2 International Calls and SMS (From Türkiye to Other Countries)

2A To USA 120 mins/month 50 Call Packages X 12 Months = 600

2B To Europe 100 mins/month 50 Call Packages X 12 Months = 600

2C Other Countries outside of 3A 60 mins/month 20 Call Packages X 12 Months = 240

2D SMS to US, Europe and Other Countries 500 SMS/month 100 SMS/month 100 SMS Packages X

12 Months = 1200

Total Package Price for International Calls and SMS (2A+2B+2C+2D)

3 International Monthly Roaming Packages (Voice + Internet + SMS)

3A In USA and Europe 1000 min Voice + 1GB Data + 100 SMS

50 Roaming

50 Roaming

20 Roaming

∑ First Option Year Annual Total for Standard Services (Total Prices of 1+2+3+4)

III.C SECOND OPTION YEAR OF SERVICE

SECOND OPTION YEAR: Monthly subscription plan — fixed rate per phone, billed monthly for approximately 1,300 lines, in accordance with the services specified in the line items below. (The second option year of the contract will commence on the date indicated in the Task Order and will continue for a period of 12 months.)

# Description Minimum Technical

Requirement Per Subscription Plan

Estimated Yearly Quantity

Unit Price Per Month

(TL)

Total Yearly Price (Unit Price Per Month

X 12 Months) (TL)

1 Voice + SMS + Internet Package for Usage within Türkiye

1A Calls within Embassy "Mobile" Group 3000 mins/month

Country 20 Gb/month

1D SMS within the Country 1000 SMS/month

Total Package Price for Usage within Türkiye (1A+1B+1C+1D)

2 International Calls and SMS (From Türkiye to Other Countries)

2A To USA 120 mins/month 50 Call Packages X 12 Months = 600

2B To Europe 100 mins/month 50 Call Packages X 12 Months = 600

2C Other Countries outside of 3A 60 mins/month 20 Call Packages X 12 Months = 240

2D SMS to US, Europe and Other Countries 500 SMS/month 100 SMS/month 100 SMS Packages X

12 Months = 1200

Total Package Price for International Calls and SMS (2A+2B+2C+2D)

3 International Monthly Roaming Packages (Voice + Internet + SMS)

3A In USA and Europe 1000 min Voice + 1GB Data + 100 SMS

50 Roaming

50 Roaming

20 Roaming

∑ Second Option Year Annual Total for Standard Services (Total Prices of 1+2+3+4)

Base Year Service Total (TL)

First Option Year Service Total (TL)

Second Option Year Service Total (TL)

GRAND TOTAL FOR BASE + ALL OPTION YEARS (TL)

During this contract period, the Government shall place orders totaling a minimum of 12 months of service. This reflects the contract guarantee minimum for this period of performance. The amount of all orders shall not exceed 36 months of service. This reflects the contract maximum for this period of performance.

CONTINUATION TO SF-1449

RFQ NUMBER 19TU1525Q3006

INDEFINITE DELIVERY/INDEFINITE QUANTITY CONTRACT

SCHEDULE OF SERVICES, BLOCK 20

(Attachment 1)

1. PERFORMANCE WORK STATEMENT

This solicitation is for the provision of mobile telephone services in support of approximately 1,300 official lines used by the U.S. Embassy in Ankara and the U.S. Consulates in Istanbul, Adana, and Izmir. The Contractor shall provide comprehensive mobile telecommunications services, including but not limited to:

• Domestic calls within Türkiye

• International calling

• International roaming

• Wireless Application Protocol (WAP) access

• SMS messaging

• Voicemail (in English and Turkish)

• Mobile data services

• 24/7 customer support

• Detailed call billing and reporting

The Contractor shall ensure that all connections provided through its network are of the highest quality—clear, uninterrupted, and free from static. Any network issues shall be resolved without delay, and the Contracting Officer’s Representative (COR) must be notified immediately regarding the nature of the issue and the corrective actions taken.

1.2 CALLS WITHIN TÜRKIYE

The Contractor shall ensure a minimum of 90% local network coverage throughout Türkiye on a 24-hour basis, with particular emphasis on urban centers and primary transportation routes.

1.3 INTERNATIONAL CALLS

The Contractor shall ensure continuous international connectivity, 24 hours a day, with the United States, all European countries, and all other global destinations where telephone service is available.

1.4 INTERNATIONAL ROAMING

The Contractor shall provide the broadest possible international roaming coverage, with particular emphasis on ensuring reliable roaming services throughout Europe and the United States, as these are of special interest to the Government. The Contractor shall submit, as part of the proposal, a coverage map indicating both voice and data roaming availability. Roaming prices shall be based on the Contractor’s agreements with international partners. Any changes to roaming rates must be formally documented by the Contractor and, upon acceptance, will be reflected in the applicable unit prices. Roaming packages shall include all standard and preferred services required under this contract.

1.5 WIRELESS APPLICATION PROTOCOL (WAP)

The Contractor shall provide internet connectivity through its network to access Wireless Application Protocol (WAP)-enabled internet sites.

1.6 SMS MESSAGING

The Contractor shall provide uninterrupted, 24/7 access to SMS messaging services.

1.7 VOICE MAIL

The Contractor shall provide voicemail services in both English and Turkish. A separate voicemail box shall be configured for each phone number in accordance with standard industry practices.

1.8 DATA SERVICES

The Contractor shall provide continuous, high-speed mobile data services for all subscribed mobile devices under this contract. These services must support secure and reliable internet access for web browsing, email, video conferencing, VPN connectivity, and the use of mobile applications essential to Government operations.

At a minimum, the data services shall include:

• Network capability of 4G LTE or higher (5G preferred where available);

• Unrestricted domestic data usage within Türkiye, subject to clearly defined Fair Usage

Policies (if applicable);

• International data roaming in specified regions and countries, with transparent and pre-disclosed rates;

• Secure data transmission protocols and network reliability with a minimum 99% service availability;

• Real-time data usage monitoring and reporting for each line;

• 24/7 technical support to ensure uninterrupted service and timely issue resolution.

The Contractor shall ensure that all data services are fully compliant with local telecommunications regulations and provide consistent performance across all service areas.

1.9 CUSTOMER SERVICE

The Contractor shall provide technical support through the designated Project Manager for all matters related to mobile telephone services, including voicemail setup, roaming inquiries, device features, number changes, reporting of lost or stolen devices, manufacturer warranty information, and any other service-related issues.

1.10 DETAILED BILLING

1.10.1 The Contractor shall provide a monthly itemized breakdown of calls made from each individual number. The breakdown shall clearly include the following details for each call:

• Called number

• Date and time of the call

• Duration of the call

• Associated cost

1.10.2 The monthly call detail reports shall be submitted to the Contracting Officer’s Representative (COR) no later than the end of each current month, covering call activity from the previous month. Reports shall be delivered to the following address:

U.S. Embassy in Ankara Diplomatic Technologies Attn: Telephone Services Unit 1480 Sokak No: 1 Çukurambar, Ankara

U.S. Consulate General in Istanbul Diplomatic Technologies Kaplıcalar Mevkii Sokak No:2 Istinye/Istanbul

U.S. Consulate in Adana Diplomatic Technologies Güzelevler Mah. Girne Bulvarı No: 212 Yüreğir, Adana

1.11 Reserved

2. INVOICING

The Contractor shall submit monthly invoices to the Contracting Officer’s Representative (COR) at the address provided below. Each invoice must be complete and accurate, and shall include the following information:

• Contractor's name and bank account information for wire transfer payments

• Invoice date

• Contract number

• A summary listing each line with the total monthly charge in local currency

• A detailed invoice for each agency, attached to the summary invoice, showing the cost breakdown by telephone line in accordance with the pricing schedule

• A detailed list of all calls made for each line

• Any prompt payment discount offered

• Name, title, telephone number, and address of the Contractor’s point of contact for invoice inquiries

Invoices that do not contain the required information may be deemed improper and returned to the Contractor within seven (7) calendar days. The Contractor shall be responsible for submitting a corrected invoice promptly.

The COR will distribute the detailed invoice to the appropriate agency representative for review. Each representative will either approve the invoice for payment or notify the COR of any discrepancies.

The COR will serve as the primary point of contact for resolving all invoice-related issues with the Contractor.

All invoices shall be submitted to the following address:

U.S. Embassy in Ankara Information Resource Management Attn: Telephone Services Unit 1480 Sokak No: 1, Çukurambar, Ankara

U.S. Consulate in Adana Information Resource Management Güzelevler Mah. Girne Bul. No. 212, Yüreğir, Adana

U.S. Consulate General in Istanbul Information Resource Management Kaplıcalar Mevkii Sokak No:2 Istinye/Istanbul

Payment shall be made in local currency via Electronic Funds Transfer (EFT) within thirty (30) days following receipt of a proper invoice.

The Government will provide annual documentation verifying its direct exemption from Value Added Tax (VAT), in accordance with applicable host country VAT regulations.

3. KEY PERSONNEL

3.1 The Project Manager assigned to this contract must be proficient in both English and Turkish. The Contractor shall designate the following individual as key personnel for contract administration:

POSITION/FUNCTION ___________________ NAME _________________

Project Manager

3.2 During the first 90 days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is required due to illness, death, or termination of employment.

The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide the information required below to the Contracting Officer at least 15 days before making any permanent substitutions.

3.3 After the first 90 days of performance, the Contractor may substitute a key person if the Contractor determines that it is necessary. The Contractor shall notify the Contracting Officer of the proposed action immediately. Prior to making the substitution, the Contractor will provide the information required below to the Contracting Officer.

3.4 The Contractor shall provide a detailed explanation of the circumstances requiring the proposed substitution, a complete resume for the proposed substitute. The proposed substitute shall possess qualifications comparable to the original key person. The Contracting Officer will notify the Contractor of its approval or disapproval of the substitution within 15 calendar days after receiving the required information. The Government will modify the contract to reflect any changes in key personnel.

4. PERMITS

Without additional cost to the Government, the Contractor shall obtain all permits, licenses, and appointments required for the work under this contract. The Contractor shall obtain these permits, licenses, and appointments in compliance with applicable Türkiye laws.

5. GOVERNMENT FURNISHED PROPERTY

5.1 The Government intends to use Government Owned Equipment and Accessories.

5.2 The Contractor shall provide a fully functional SIM card, telephone number, and appropriate security codes for all existing Government cellphones.

6. ADDITION OF NEW LINES

The Contractor shall provide a fully functional SIM card, assigned telephone number, and all necessary security codes to the Contracting Officer’s Representative (COR) within 24 hours of receiving a delivery order under the contract.

7. NON-OFFICIAL LINES

This contract shall be used exclusively for official U.S. Government purposes.

8. DISCLOSURE OF INFORMATION

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

9. TECHNOLOGICAL REFRESHMENT

After contract award, the Government may; pursuant to FAR clause 52.212-4 - Contract Terms and Conditions –Commercial Items, paragraph (c), Changes; request changes within the scope of the contract. These changes may be required to improve performance or react to changes in technology.

The Contractor may propose for the Government’s technological refreshment, substitutions or additions for any provided products or services that may become available as a result of technological improvements. The Government may, at any time during the term of this contract or any extensions thereof, modify the contract to acquire products which are similar to those under the contract and that the Contractor has, or has not, formally announced for marketing purposes. This action is considered to be within the scope of the contract. At the option of the Government, a demonstration of the substitute product may be required. The Government is under no obligation to modify the contract in response to the proposed additions or substitutions.

Such substitutions or additions may include any part of, or all of, a given product(s) provided that the following conditions are met and substantiated by documentation in the technological refreshment proposal:

The proposed product(s) shall meet all of the technical specifications of this document and conform to the terms and conditions cited in the contract.

The proposed product(s) shall have the capacity, performance, or functional characteristics equal to or greater than, the current product(s).

The proposal shall discuss the impact on hardware, services, and delivery schedules. The cost of the changes not specifically addressed in the proposal shall be borne entirely by the Contractor.

Contractor has the right to withdraw, in whole or in part, any technological refreshment proposal prior to acceptance by the Government. Contractor will use commercially reasonable efforts to ensure that prices for substitutions or additions are comparable to replaced or discontinued products.

If a technological refreshment proposal is accepted and made a part of this contract, an equitable adjustment, increasing or decreasing the contract price, may be required and any other affected provisions of this contract shall be made in accordance with FAR clause 52.212-4, paragraph (c), Changes, and other applicable clauses of the contract.

10. SPECIAL SHORT-TERM PROMOTION

For the entire contract duration, the Contractor will offer the U.S. Embassy the option to take advantage of any promotional programs that it offers and that is suited for use by U.S. Embassy staff. The U.S. Embassy, at its own discretion, will have the option to take or reject the opportunity.

11. DELIVERY ORDERS

The Contracting Officer will issue delivery orders to order services to the Contractor for performance of work under this contract. If an order is given orally, it will be followed up by a written delivery order within 7 days.

12. Reserved

13. Reserved

14. CUSTOMER SERVICE CENTERS

The Contractor is to provide a telephone number for the purpose of reporting equipment problems and malfunctions, billing inquiries, and customer question regarding accounts and services.

15. SURVIVABILITY AND RECOVERY

The Contractor shall maintain a functional network survivability system to ensure continued service during emergencies or major disasters, including scenarios in which networks may become congested or partially inoperable. Additionally, the Contractor shall have a documented recovery plan in place to address and mitigate such events, ensuring prompt restoration of service.

16. QUALITY ASSURANCE AND SURVEILLANCE PLAN (QASP)

This plan provides an effective method to promote satisfactory contractor performance. The QASP provides a method for the Contracting Officer's Representative (COR) to monitor Contractor performance, advise the Contractor of unsatisfactory performance, and notify the Contracting Officer of continued unsatisfactory performance. The Contractor, not the Government, is responsible for management and quality control to meet the terms of the contract. The role of the Government is to monitor quality to ensure that contract standards are achieved.

Performance Objective Scope of Work Para Performance Threshold Services.

Performs all mobile phone voice and data connectivity services set forth in the scope of work.

1. thru 16.

All required services are performed and no more than three (3) customer complaint is received per month.

Attachment 2: CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

SOFTWARE PRODUCER ATTESTATION FORM

Cybersecurity and Infrastructure Security Agency (CISA) Secure Software

Development Attestation Form Instructions

Read all instructions before completing this form

Privacy Act Statement

[NOTE: This Privacy Act Statement is unique to DHS. All agencies using this common form will need to provide an agency-unique Privacy Act Statement when they request to use this form.

Each agency using this common form should provide Privacy Act Statements that conform to its applicable agency procedures and requirements.]

Authority: 44 U.S.C. § 3554, Executive Order (E.O.) 14028, “Improving the Nation’s Cybersecurity,” and OMB Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” as amended by OMB Memorandum M-23-16, “Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” authorize the collection of this information.

Purpose: The purpose of this form is to provide the Federal Government assurances that software used by agencies is securely developed.

Background: This information may be disclosed as generally permitted under Executive Order 14028, Improving the Nation’s Cybersecurity (E.O. 14028) and Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices” (M-22-18), as amended. This form collects contact information from vendor employees who make the attestation. For DHS, information may be disclosed as necessary and authorized by the routine uses published in DHS/ALL-002 Department of Homeland Security (DHS) Mailing and Other List System, November 25, 2008, 73 FR 71659.

Failure to provide any of the information requested may result in the agency no longer utilizing the software at issue. Willfully providing false or misleading information may constitute a violation of 18 U.S.C. § 1001, a criminal statute.

What is the Purpose of Filling out this Form?

The Federal Information Security Modernization Act of 2014 (FISMA) requires each Federal agency to provide security protections for both “information collected or maintained by or on behalf of an agency” and for “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” FISMA and other provisions of Federal law authorize the Director of the Office of Management and Budget (OMB) to promulgate information security standards for information security systems, including to ensure compliance with standards promulgated by the National Institute of Standards and Technology (NIST).

Executive Order 14028, “Improving the Nation’s Cybersecurity” (E.O. 14028), emphasizes the importance of securing software used by the Federal Government to perform its critical functions. To further this objective, E.O. 14028 required NIST to issue guidance “identifying practices that enhance the security of the software supply chain.”1 The NIST Secure Software Development Framework (SSDF) (SP 800-218),2 and the NIST Software Supply Chain Security Guidance3 (these two documents, taken together, are hereinafter referred to as “NIST Guidance”) include a set of practices that create the foundation for developing secure software.

E.O. 14028 further requires that the Director of OMB take appropriate steps to ensure that Federal agencies comply with NIST Guidance. To that end, OMB issued Memorandum M-22- 18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices” (M-22-18), on September 14, 2022. That memorandum was updated on June 9, 2023, through OMB Memorandum M-23-16, “Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices” (M-23-16). M-22-18, as amended by M-23-16, provides that a Federal agency may use software subject to M-22-18’s requirements only if the producer of that software has first attested to compliance with Federal Government-specified secure software development practices drawn from the SSDF.

This self-attestation form identifies the minimum secure software development requirements a software producer must meet, and attest to meeting, before software subject to the requirements of M-22-18 and M-23-16 may be used by Federal agencies. This form is used by software producers to attest that the software they produce is developed in conformity with specified secure software development practices.

Software requires self-attestation if any of the conditions is met:

1. The software was developed after September 14, 2022;

2. The software was developed prior to September 14, 2022, but was modified by major version changes (e.g., using a semantic versioning schema of Major.Minor.Patch, the software version number goes from 2.5 to 3.0) after September 14, 2022; or

1 Executive Order on Improving the Nation’s Cybersecurity (E.O. 14028), Section 4(e).

2 Available at: https://csrc.nist.gov/Projects/ssdf 3 Available at: https://www.nist.gov/system/files/documents/2022/02/04/software-supply-chain-security-guidanceunder-EO-14028-section-4e.pdf https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://csrc.nist.gov/Projects/ssdf https://www.nist.gov/system/files/documents/2022/02/04/software-supply-chain-security-guidanceunder-EO-14028-section-4e.pdf https://www.nist.gov/system/files/documents/2022/02/04/software-supply-chain-security-guidanceunder-EO-14028-section-4e.pdf

ϒ

ϒ

3. The producer delivers continuous changes to the software code (as is the case for software-as-a-service products or other products using continuous delivery/continuous deployment).

Software products and components in the following categories are not in scope for M-22-18, as amended by M-23-16, and do not require a self-attestation:

1. Software developed by Federal agencies;

2. Open-source software that is freely and directly obtained by a Federal agency;

3. Third-party open source and proprietary components that are incorporated into the software end product used by the agency; or

4. Software that is freely obtained and publicly available.

Software producers who utilize third party components in their software are required to attest that they have taken specific steps, detailed in “Section III – Attestation and Signature” of the common form, to minimize the risks of relying on such components in their products.

Agency-specific instructions may be provided to the software producer outside of this common form. Conformance to agency-specific requirements may be included with this form as an addendum; agencies are responsible for fulfilling any Paperwork Reduction Act requirements applicable to agency-specific additions.

If a software producer is unable to submit via the online form, they may email a pdf version of the form to the respective agency:

Online Form Instructions:

Selecting the provided URL: https://softwaresecurity.cisa.gov

OR

Local PDF Instructions:

Saving the completed form as a PDF using the following naming convention:

Software Producer: Software Producers name which manufactured/compiled the software product Product name: Complete name of software product Version: Version number of software product Attestation date: Date the software product was attested:

e.g. [Software Producer]_[Product]_[Version]_[Attestation Date] →Acme_SecuritySuite_4.6.2.1_20230124 Individual agencies will provide their respective email addresses.

Filling Out the Form

Software Producer Information Please provide a description of the software and information about the software producer. All fields in the attestation form are required to be appropriately completed by the software producer. Incomplete forms will not be accepted.

https://softwaresecurity.cisa.gov/

The form must be signed by the Chief Executive Officer (CEO) of the software producer or their designee, who must be an employee of the software producer and have the authority to bind the corporation. By signing, that individual attests that the software in question is developed in conformity with the secure software development practices delineated within this form. The software may be used by a federal agency, consistent with the requirements of M-22-18, as amended by M-23-16, once the agency has received an appropriately signed copy of the attestation form.

The software producer may choose to demonstrate conformance with the minimum requirements by submitting a third-party assessment documenting that conformance. A third-party assessment must be performed by a Third Party Assessor Organization (3PAO) that has either been FedRAMP certified or approved in writing by an appropriate agency official. The 3PAO must use relevant NIST Guidance that includes all elements outlined in this form as part of the assessment baseline. To rely upon a third-party assessment, the software producer must check the appropriate box in Section III and attach the assessment to the form. The producer need not sign the form in this instance. The agency shall take appropriate steps to ensure that the assessment is not posted publicly, either by the vendor or by the agency itself.

Additional Information:

In the event that an agency cannot obtain a completed self-attestation from the software producer, an agency may still decide to use the producer’s software if the producer identifies the practices to which they cannot attest, documents practices they have in place to mitigate associated risks, and submits a plan of actions and milestones (POA&M) to the agency. When an attestation is not provided, per OMB guidance, agencies are responsible for requesting from OMB an extension or waiver for the continued use.

This common self-attestation form fulfills the minimum requirements set forth by OMB in M- 22-18, as amended by M-23-16.

The attestation form, background, and instructions are subject to change and may be modified.

Secure Software Development Attestation Form Version 1.0

Section I

New Attestation Attestation Following Extension or Waiver Revised Attestation

Type of Attestation: Company-wide Individual Product Multiple Products or Specific

Product Version(s) (please provide complete list)

If this attestation is for an individual product or multiple products, provide the software name, version number, and release/publish date to which this attestation applies. Additional pages can be attached to this attestation if more lines are needed:

Product(s) Name Version Number4

(if applicable) Release/Publish Date

(if applicable)

For the above specified software, this form does not cover software or any components of that software that fall into the following categories:

1. Software developed by Federal agencies;

2. Open source software that is freely and directly obtained directly by a Federal agency;

3. Third-party open source and proprietary components that are incorporated into the software end product used by the agency; or

4. Software that is freely obtained and publicly available.

Note: In signing this attestation, software producers are attesting to adhering to the secure software development practices outlined in Section III for code developed by the producer.

Section II

1. Software Producer Information Company Name:

Address:

City:

4 Attestations are binding for future versions of the named software product unless and until the software producer notifies the agencies to which it previously submitted the form that its development practices no longer conform to the required elements specified in the attestation.

State or Province:

Postal Code:

Country:

Company Website:

2. Primary Contact for this Document and Related Information (may be an individual, role, or group):

Name:

Title:

Address:

Phone Number:

Email Address (may be an alias/distribution list):

Section III

Attestation and Signature

On behalf of the above-specified company, I attest that, to the best of my knowledge, [software producer] presently makes consistent use of the following practices, derived from the secure software development framework (SSDF),5 in developing the software identified in Section I:

1) The software is developed and built in secure environments. Those environments are secured by the following actions, at a minimum:

a) Separating and protecting each environment involved in developing and building software;

b) Regularly logging, monitoring, and auditing trust relationships used for authorization and access:

i) to any software development and build environments; and

ii) among components within each environment;

c) Enforcing multi-factor authentication and conditional access across the environments relevant to developing and building software in a manner that minimizes security risk;

d) Taking consistent and reasonable steps to document, as well as minimize use or inclusion of software products that create undue risk within the environments used to develop and

5 The SSDF are standards and best practices established by the National Institute of Standards and Technology (NIST) in NIST Special Publication (SP) 800-218.

build software;

e) Encrypting sensitive data, such as credentials, to the extent practicable and based on risk;

f) Implementing defensive cybersecurity practices, including continuous monitoring of operations and alerts and, as necessary, responding to suspected and confirmed cyber incidents;

2) The software producer makes a good-faith effort to maintain trusted source code supply chains by employing automated tools or comparable processes to address the security of internal code and third-party components and manage related vulnerabilities;

3) The software producer maintains provenance for internal code and third-party components incorporated into the software to the greatest extent feasible;

4) The software producer employs automated tools or comparable processes that check for security vulnerabilities. In addition:

a) The software producer operates these processes on an ongoing basis and prior to product, version, or update releases;

b) The software producer has a policy or process to address discovered security vulnerabilities prior to product release; and

c) The software producer operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies.

I further attest that the software producer will notify any agency to which it has submitted this form if and when the producer ceases to make consistent use of the practices identified above in developing the software.

Signature of CEO or Designee with authority to bind the corporation

Date (YYYY-MM-DD):

Name:

Title:

OR

A certified FedRAMP Third Party Assessor Organization (3PAO) or other 3PAO approved in writing by an appropriate agency official has evaluated our conformance to all elements in this form. The 3PAO used relevant NIST Guidance that includes all elements outlined in this form as the assessment baseline. The assessment is attached.

ATTACHMENT(S):

• [Artifact/Addendum Title]: [Artifact/Addendum Description]

Burden Statement

The public reporting burden to complete this information collection is estimated at 3 hours and 20 minutes per response, including time for reviewing instructions, searching data sources, gathering, and maintaining the data needed, and completing and reviewing the collection of information. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number and expiration date. The OMB control number assigned to this collection is 1670-0052, which expires on 03/31/2027. Send comments regarding this burden estimate or any other aspect of this collection information, including suggestions for reducing this burden, to DHS/CISA CSCRM@cisa.dhs.gov. ATTN: PRA 1670-0052 Secure Software Self-Attestation Common Form.

mailto:CSCRM@cisa.dhs.gov

Minimum Attestation References:

APPENDIX

REFERENCES

The minimum requirements within the Secure Software Attestation Form address requirements put forth in E.O. 14028 subsection (4)(e). A mapping to specific SSDF practices and tasks is provided for reference purposes.

Attestation Requirements Related

E.O.

14028 Subsection

Related SSDF Practices and Tasks

1) The software is developed and built in secure environments. Those environments are secured by the following actions, at a minimum:

4e(i)

[See rows below]

a) Separating and protecting each environment involved in developing and building software;

4e(i)(A)

PO.5.1

b) Regularly logging, monitoring, and auditing trust relationships used for authorization and access:

i) to any software development and build environments; and

ii) among components within each environment;

4e(i)(B)

c) Enforcing multi-factor authentication and conditional access across the environments relevant to developing and building software in a manner that minimizes security risk;

4e(i)(C)

PO.5.1, PO.5.2

d) Taking consistent and reasonable steps to document, as well as minimize use or inclusion of software products that create undue risk within the environments used to develop and build software;

4e(i)(D)

e) Encrypting sensitive data, such as credentials, to the extent practicable and based on risk;

4e(i)(E)

PO.5.2

f) Implementing defensive cybersecurity practices, including continuous monitoring of operations and alerts and, as necessary, 4e(i)(F)

PO.3.2, PO.3.3,

PO.5.1, PO.5.2

responding to suspected and confirmed cyber incidents;

2) The software producer makes a good-faith effort to maintain trusted source code supply chains by employing automated tools or comparable processes to address the security of internal code and third-party components and manage related vulnerabilities;

4e(iii)

PO 1.1, PO.3.1,

PO.3.2, PO.5.1,

PO.5.2, PS.1.1,

PS.2.1, PS.3.1,

PW.4.1, PW.4.4,

PW 7.1, PW 8.1,

RV 1.1

3) The software producer maintains provenance for internal code and third-party components incorporated into the software to the greatest extent feasible;

4e(vi)

PO.1.3, PO.3.2,

PO.5.1, PO.5.2,

PS.3.1, PS.3.2,

PW.4.1, PW.4.4,

RV.1.1, RV.1.2

4) The software producer employed automated tools or comparable processes that check for security vulnerabilities. In addition:

a) The software producer operates these processes on an ongoing basis and prior to product, version, or update releases;

b) The software producer has a policy or process to address discovered security vulnerabilities prior to product release; and

c) The software producer operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies.

4e(iv)

PO.4.1, PO.4.2,

PS.1.1, PW.2.1,

PW.4.4, PW.5.1,

PW.6.1, PW.6.2,

PW.7.1, PW.7.2,

PW.8.2, PW.9.1,

PW.9.2, RV.1.1,

RV.1.2, RV.1.3,

RV.2.1, RV.2.2,

RV.3.3

Attachment 3: CERTIFICATION REGARDING COMPLIANCE WITH APPLICABLE

FEDERAL ANTI-DISCRIMINATION LAW

All Department of State contractors must certify that they do not operate any programs promoting DEI that violate any applicable anti-discrimination laws and agree that such certification is material for purposes of the government’s payment decision and therefore subject to the False Claims Act. See 31 U.S.C. 3729(b)(4).

DIRECTIONS FOR CONTRACTORS and/or OFFERORS

1.Read the entire certification provided below.

2.After you have read the provisions, please check the appropriate boxes.

3.Upon completion of Step 2, fill out the representation below. NOTE: This certification is made by a person with the authority to bind the contractor or offeror.

4.Return completed form to the Contracting Officer/POC shown in the e-mail.

CERTIFICATION:

The Contractor or prospective offeror certifies they:

☐ are in compliance in all respects with all applicable Federal anti-discrimination laws is material to the government’s payment decisions for purposes of section 31 USC 3729(b)(4) (False Claims Act); and

☐ do not operate any programs promoting Diversity, Equity, and Inclusion that violate any applicable Federal anti-discrimination laws.

Contractor or Offeror Name (Printed or Typed): _______________________________________

Authorized Representative Name and Title: __________________________________________

Authorized Representative Signature and Date: _______________________________________

Solicitation or Contract Number: ____19TU1525Q3006_________________________________

SECTION 2 - CONTRACT CLAUSES

52.212-4 CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS

(DEC 2022) IS INCORPORATED BY REFERENCE. (SEE SF-1449,

BLOCK 27A)

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS-COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (MAR 2023)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (NOV 2021) (Section 1634 of Pub. L.

115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (AUG 1996) ( 31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN 2020), with Alternate I (NOV 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV 2021) ( 41 U.S.C. 3509)).

https://www.acquisition.gov/far/part-52#FAR_52_203_19 https://www.acquisition.gov/far/part-52#FAR_52_204_23 https://www.acquisition.gov/far/part-52#FAR_52_204_25…