Next Generation (NextGen) Passport Personalization Printers Support

Amendment / Modification

This document is Amendment 0003, which modifies the solicitation. Key changes include:

• Section B - Supplies or Services and Prices/Costs: Clarifies the contract type as a single-award indefinite-delivery, indefinite-quantity (IDIQ) contract. It also specifies that Firm Fixed Price (FFP) or Time and Material (T&M) Delivery/Task orders may be issued, potentially including hybrid orders.
• Section B.3 - Minimum and Maximum Quantities: Defines the contract minimum for support services and sets maximum quantities for high-capacity printers (15) and low-capacity printers (10), including associated costs.
• Section F.3 - Deliverables/Reports: Lists numerous deliverables with their expected submission timelines, including Kick-Off Meeting/Briefing, Program Management Plan, Security Operations Plan, various reports (Weekly Activity, Monthly Contract Status, etc.), and transition plans.
• Section H.4 - Security: Outlines stringent security requirements, including a TOP SECRET facility clearance, personnel security clearances (SECRET or TOP SECRET), compliance with HSPD-12 for PIV cards, and adherence to the National Industrial Security Program Operating Manual (DOD 5220.22-M).
• Section H.13 - Cybersecurity Supply Chain Risk Management (C-SCRM): Details contractor responsibilities for identifying, assessing, monitoring, and mitigating cybersecurity supply chain risks, including requirements for Software Bills of Materials (SBOM) and vulnerability reporting.
• Section L.1.5 - Department of State Subcontracting Goals: Sets specific subcontracting goals for Fiscal Year 2024 for Small Businesses (38%), Small Disadvantaged Businesses (5%), Small Woman-Owned Businesses (5%), HUBZone Small Businesses (3%), and Service-Disabled Veteran-Owned Small Businesses (3%).
• Section M.6 - Evaluation Factors and Order of Importance: Establishes the evaluation order: Factor 1 (Technical) is most important, followed by Factor 2 (Past Performance), Factor 3 (C-SCRM - Go/No-Go), and Factor 4 (Price). Technical and Past Performance combined are significantly more important than Price.

Sections B, F, H, L, and M have been modified or clarified.

This amendment does not appear to change the proposal due date but clarifies requirements and evaluation criteria that will impact proposal preparation and evaluation.

Amendment / Modification

This amendment provides revised documents and incorporates Questions and Answers into the solicitation. Specifically, it includes revised Appendix 1, Appendix 2, Attachment A - Pricing Guide, and the Questions and Answers.

• Appendix 1
• Appendix 2
• Attachment A - Pricing Guide
• Questions and Answers

This amendment does not explicitly state any changes to proposal deadlines or evaluation factors, but bidders should review the incorporated Questions and Answers and revised appendices/attachments for any potential impact on their proposals.

Form / Attachment / Pricing Sheet

This document, "Attachment A - Pricing Table," provides a detailed breakdown of estimated costs for the Next Generation Passport (NGP) project across various CLINs (Contract Line Item Numbers) and performance periods (Base Year and Option Years 1-4). It serves as an Independent Government Cost Estimate (IGCE) and includes assumptions and a revision history.

• CLIN Structure: Details costs by CLIN, covering areas such as Transition, Program Management Support, Printer Hardware (High and Low Capacity), Shipping, Installation, Integration, Training, Warranties (BMOne, BMPro), Consumable Materials, Enhancement Software, Labor Categories (Full Time and Extended Hours), Vendor Support Site, Relocation, Travel, and Decommissioning.
• Cost Breakdown: Presents estimated costs per CLIN for the Base Year and four Option Years, along with a Total Base + Options column. Some sheets also include a '+20%' column, likely for contingency.
• Assumptions: Outlines the basis for the cost estimates, including FTE hours, labor rates, period of performance (12-month base + 4 12-month options), use of historical data, and escalation rates (3% for specific CLINs, 5% for others).
• Revision History: Tracks changes made to the IGCE, noting revisions related to new print centers, labor categories, escalations, and the inclusion/removal of specific printer types.

This pricing table provides insight into the government's cost expectations for various components of the NGP project. Bidders can use this information to understand the relative cost drivers and to inform their own pricing strategies when developing proposals. The detailed CLIN structure also clarifies the scope of work anticipated for each element of the contract.

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide and support Next Generation (NextGen) Passport Personalization Printers and associated services for the U.S. Department of State (DOS) Bureau of Consular Affairs (CA), Office of Consular Systems and Technology (CA/CST). These printers are crucial for personalizing U.S. passport books, enhancing security, durability, and quality.

• Program Management: Oversee all contract activities, including resource, cost, quality, risk, schedule, and communication management.

• Support Services: Provide support for laser engraving Personalization Printers at Domestic Passport Sites, including Issuance Sites (Centers and Agencies) and Support Sites.

• Printer Provisioning: Supply High-Capacity and Low-Capacity NextGen Passport Personalization Printers with laser engraving, color printing, and chip personalization capabilities.

• Consumable Materials: Supply all necessary consumable materials for printer operation.

• Installation, Integration, and Training: Provide optional services for printer installation, integration with existing DOS systems, and comprehensive training for operators and maintenance staff.

• Warranty and Maintenance: Offer initial and extended warranties, including preventive and remedial maintenance.

• Transition Support: Develop and execute a Transition Plan for services to or from the Government or another Contractor.

• Enhancement Software: Provide software analysis, design, and development support for new components and system upgrades.

• Relocation Services: Provide optional services for the physical relocation of printers.

• Decommissioning: Provide optional services for the proper destruction of printers.

• Printers must meet specific throughput rates (High-Capacity: 300+ books/hour; Low-Capacity: 100+ books/hour).

• Printers must integrate with existing DOS technology environments per an Interface Control Document (ICD).

• Support services must ensure printers are operational within four hours of notification of failure at any Issuance Site.

• Service Desk must be responsive 24/7, with incident management processes adhering to ITIL standards.

• Security requirements and compliance with NIST SP800-53 Rev 4 or later are mandatory.

• Performance will occur at Domestic Passport Sites, including 29 domestic passport Agencies, Passport Centers, non-production environment (NPE) sites, and new site locations as required.

• Security: Compliance with all Departmental security policies, Foreign Affairs Manuals (FAM), and specific security requirements for passport printers and materials.

• Integration: Printers must integrate with the DOS Travel Document Issuance System (TDIS) and future systems.

• Compliance: Adherence to ICAO Document 9303 standards for machine-readable travel documents and Section 508 accessibility standards.

• Reporting: Regular reporting including Weekly Activity Reports (WARs), Monthly Contract Status Reports (CSRs), and Printer Operational Status Reports.

• Management: Adherence to SAFe Agile practices, ITIL, and CMMI best practices.

Amendment / Modification

This document is Amendment 0003 to the solicitation. It primarily details changes related to Appendix I, which is not fully provided in the text. The amendment indicates that changes have been accepted for Appendix I.

• Appendix I (specific changes not detailed in the provided text)

No direct impact on proposal deadlines or submission requirements is stated in the provided text, beyond the implied update to Appendix I. Bidders should ensure they are referencing the most current version of all appendices, including Appendix I, as updated by this amendment.

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide and support Next Generation Passport Personalization Printers and associated services for the U.S. Department of State (DOS), Bureau of Consular Affairs (CA), Office of Consular Systems and Technology (CA/CST). These printers are crucial for enhancing the security, durability, and quality of U.S. passport books.

• Provision and Support: Supply and maintain NextGen Passport Personalization Printers (both High-Capacity and Low-Capacity models) at all Domestic Passport Sites, including Agencies, Centers, non-production environments, and new locations.

• Services: Includes Program Management, Transition Support, Consumable Materials, Warranty, On-site Support Services, Enhancement Software, Relocation, and Travel.

• Optional Services: Consulting Services, Shipping with or without storage, Installation, Integration, Training, Warehouse and Security Augmentation, Relocation, and Decommissioning of Printers.

• Key Functions: Printers must integrate into existing DOS technology environments, support laser engraving on polycarbonate data pages, color printing on endorsement pages, embedded chip personalization (ICAO Document 9303 compliant), and inline automated quality inspection.

• Printer Throughput: High-Capacity: 300+ books/hour; Low-Capacity: 100+ books/hour.

• Availability: Issuance sites must personalize passports within 4 hours of failure. If two printers are present, one can be inoperable for up to two business days.

• Support: Service Desk responsive 24/7, with incident resolution aiming for return to service within 4 hours.

• Quality: Printers must meet ICAO standards for readability, durability, and security features.

• Locations: All Consular Affairs Domestic Operational Facilities, including 29 domestic Passport Agencies, Passport Centers, and Support Sites.

• Duration: Not explicitly stated in this document, but implies a contract period with potential option years.

• Security: Printers must have physical and logical security features. Contractor must comply with DOS security policies and procedures (FAM, FAH, NIST SP800-53).

• Integration: Printers must be fully compatible with the Interface Control Document (ICD) and integrate with the existing Travel Document Issuance System (TDIS) and future systems.

• Compliance: Adherence to ICAO Document 9303, Section 508 Accessibility standards, OSHA safety requirements, and FCC Class A emission standards.

• Management: Requires robust Program Management, including Resource, Cost, Quality, Risk, Schedule, Scope, and Communication Management. Earned Value Management (EVM) is required.

• Transition: A 180-day transition plan for services is required for both incoming and outgoing contractors.

Questions & Answers / Clarifications

This document provides responses to vendor questions regarding the NextGen opportunity, clarifying various aspects of the solicitation, including proposal formatting, pricing, and contract clauses.

• Facility Location Documentation: Copies of leases, building schematics, and blueprints for facility locations will not count towards the 60-page limit. Only written documentation confirming facility availability at performance start will be counted.
• Duty-Free Entry: The government concurs that FAR 52.225-8 "Duty-Free Entry" will be included for pricing purposes.
• Wage Determinations: Applicable FAR clauses (52.222-41, 52.222-43, 52.222-55) are provided by reference; Wage Determinations will be provided upon award if required for this service contract.
• Optional CLINs & New Print Facility: Optional CLINs referencing "New Print Facility" do not require pricing at this time. Additional details will be provided during contract performance. SubCLINs will be added for clarity regarding shipment with or without storage for printers.
• Page Limits: The page limit for the Technical Proposal (Section L.3 Volume I) has been increased from 60 to 70 pages.
• Subcontracting Plan: For small business prime offerors, the DOS small business subcontracting goals and the requirement to submit a subcontracting plan do not apply.
• Key Personnel: Offerors may propose additional key personnel beyond the Program and Deputy Program Manager.
• TS FCL: If an awardee does not have an active Top Secret Facility Clearance (TS FCL), the DOS will sponsor them, and performance will not begin until the FCL is granted.

Several sections have been revised based on these clarifications, including Section L (Proposal Preparation Instructions and Formatting), Attachment A (Pricing Table), and Section F (Deliverables/Reports). Bidders should review these updated sections for accurate proposal preparation.

Amendment / Modification

• The due date for proposals has been extended.

• The due date for proposals is affected.

• The proposal deadline is extended to September 3, 2024, at 3:00 P.M. EST.

Amendment / Modification

• The due date for proposals has been extended.

• The due date for proposals is affected.

• The proposal deadline is extended to September 12, 2024, 3:00 P.M. EST.

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide and support specialized Next Generation (NextGen) Passport Personalization Printers for the U.S. Department of State (DOS), Bureau of Consular Affairs (CA), Office of Consular Systems and Technology (CA/CST). These printers are crucial for enhancing the security, durability, and quality of U.S. passport books.

• Program Management and Support Services: Comprehensive management, resource allocation, cost control, quality assurance, risk management, schedule adherence, and communication.

• Consumable Materials: Supply of all necessary consumable materials for printer operation.

• Support Services: On-site maintenance and support at various Domestic Passport Sites, including Passport Agencies, Centers, and Support Sites.

• Installation, Integration, and Training (Optional): Setup, integration with existing DOS systems, and training for printer operators.

• Enhancement Software: Development and support for software enhancements to meet evolving requirements.

• Relocation Services: Physical relocation of printers for agency moves.

• Transition Support: Planning and execution of transition-in and transition-out services.

• NextGen Passport Personalization Printers: Both High-Capacity (300+ books/hour) and Low-Capacity (100+ books/hour) models are required.

• Functionality: Printers must support laser engraving on polycarbonate data pages, color printing on endorsement pages, embedded chip personalization (ICAO Document 9303 compliant), and inline automated quality inspection.

• Security Features: Printers must incorporate physical and logical security measures to prevent unauthorized access and tampering.

• Integration: Printers must integrate with existing DOS technology environments based on a specified Interface Control Document (ICD).

• Reporting: Regular reports including Weekly Activity Reports (WARs) and Monthly Contract Status Reports (CSRs).

• Maintenance: Both preventive and remedial maintenance, with strict uptime requirements (e.g., no more than 4 hours of downtime per printer at an Issuance Site).

• Uptime: Critical for ensuring passport issuance demand is met, especially during peak seasons.

• Throughput: Specific rates for high-capacity and low-capacity printers.

• Quality: Compliance with ICAO standards for print quality, durability, and security features.

• Response Time: Service Desk and maintenance response times are critical.

• Locations: All Consular Affairs Domestic Operational Facilities, including 29 domestic Passport Agencies, Passport Centers, non-production environment (NPE) sites, and new site locations as required.

• Duration: Contract period to be defined, with transition planning for both incoming and outgoing contractors.

• Security: Compliance with all Departmental security policies, including Foreign Affairs Manual (FAM) and NIST SP800-53.

• IT Standards: Adherence to CA/CST SAFe Agile & SDLC, EA standards, ITIL v3, and other relevant methodologies.

• Transition: A 180-day transition plan is required for both incoming and outgoing contractors.

• Optional Services: Consulting, shipping with/without storage, installation, integration, training, warehouse, security augmentation, and decommissioning of printers.

Form / Attachment / Pricing Sheet

This document, "19AQMM24R0113 - Appendix I.docx", appears to be an appendix containing detailed information relevant to Section B (Supplies or Services and Prices/Costs) and other sections of the solicitation. It outlines the specific requirements for providing and supporting CA/CST Next Generation (NextGen) Passport Personalization Printers and related services.

• Services: Program management, support services, transition support, consumables, warranty, site support, lab support, enhancement software, relocation, and travel.
• Optional Services: Purchase of personalization printers, consulting, shipping, installation, integration, training, warehouse support, security augmentation, and decommission/disposal.
• Contract Type: Single-award indefinite-delivery, indefinite-quantity (IDIQ) contract. Delivery/Task orders will be Firm Fixed Price (FFP) or Time and Material (T&M), potentially hybrid.
• Quantities: Maximum of 15 high-capacity printers and 10 low-capacity printers, including all related costs.
• Pricing: Offerors must propose pricing for all CLINs using Attachment A (Pricing Table). Other Direct Costs (ODCs) are cost-reimbursable with prior approval. Travel costs are cost-reimbursable per FAR Subpart 31.2.

This appendix is crucial for bidders as it defines the core services and products being procured, the contract structure, quantity limitations, and detailed pricing and cost reimbursement guidelines. It directly informs the scope of work and the financial aspects of a proposal. Bidders must carefully review these details to understand the full extent of the requirement and to prepare accurate pricing in Attachment A.

Solicitation / RFP / RFQ

This document is a Solicitation, Offer, and Award form (SF 33) for the "NEXT GENERATION PASSPORT PRINTER SUPPORT AND RELATED SUPPLIES AND EQUIPMENT" opportunity. It outlines the terms and conditions for potential bidders to submit offers.

• The document references Sections B, F, H, J, L, and M contained in an attached Appendix I, and Section C in Appendix 2. Sections D, E, G, I, and K are procurement system generated and included with this SF33.

• Specific details regarding supplies or services, packaging, marking, inspection, acceptance, contract administration, and contract clauses are outlined in various sections.

• The solicitation number is 19AQMM24R0113.

• The date issued is 07/08/2024.

• The contract type is not explicitly stated but the form is for "SOLICITATION, OFFER, AND AWARD."

• Offers must be received by the date specified in item 8.

• Late submissions, modifications, and withdrawals are subject to Section L, Provision No. 52.214-7 or 52.215-1.

• The offeror must complete item 12, indicating the period for which the offer is valid (default is 60 calendar days).

• Discount for prompt payment is specified in Section I, Clause 52.232-8.

• Not explicitly detailed in the provided pages, but Section K covers Representations, Certifications, and Other Statements of Offerors or Respondents, which may contain eligibility information.

• The document includes a table of contents detailing various sections (B through K) and their corresponding page numbers.

• Specific clauses related to cybersecurity, contractor identification, COR designation, and electronic invoicing (IPP) are included.

Form / Attachment / Pricing Sheet

This document is a Past Performance Customer Satisfaction Survey required by the U.S. Department of State (DOS) for the Next Generation (NextGen) Passport Personalization Printers program. It is used to gather feedback from government agencies on a prospective offeror's past performance.

• Part I: Contract Information: Collects details about the contract, including contractor name, customer contact, contract number, type, period of performance, value, and a description of the requirement.
• Part II: Government Past Performance/Customer Satisfaction Evaluation: Provides evaluation criteria (Excellent, Satisfactory, Marginal, Unacceptable) across seven areas: Technical Services, Quality of Services, Timeliness of Performance, Price/Cost Control, Business Relations, Customer Satisfaction, and Overall Contract Performance.
• Evaluation Areas: Specific questions within each area assess the contractor's performance related to providing and supporting passport printers, IT integration, logistical support, personnel, program management, quality, timeliness, cost control, business relations, and customer interaction.

Prospective offerors must ensure their identified references complete this survey accurately. The feedback provided will significantly influence the evaluation of their past performance, a critical factor in the procurement process for the NextGen Passport Personalization Printers program. The survey also details the specific performance aspects the DOS will be evaluating.

Form / Attachment / Pricing Sheet

This document outlines the stringent security requirements for contractors involved in the manufacturing and maintenance of U.S. Passport Printers. It details facility, personnel, and physical security measures necessary to protect sensitive government information and equipment.

• Facility Security Clearances: Requires a TOP SECRET facility clearance for the Prime Contractor, issued by DCSA. Subcontractors must also possess commensurate clearances.
• Personnel Security Clearances: Mandates individual security clearances (TOP SECRET, SECRET, or Moderate Risk Public Trust - MRPT) for all contractor personnel accessing classified information or sensitive areas. Personnel must maintain clearances throughout the contract.
• Foreign Ownership, Control, or Influence (FOCI): U.S. and foreign firms must be evaluated for FOCI. Foreign firms require specific agreements and clearances.
• Physical Security: Dictates requirements for secure manufacturing facilities, including CCTV surveillance, alarm systems, access control, perimeter fencing, and secure storage areas.
• Data Protection: Specifies procedures for handling "Sensitive but Unclassified" (SBU) information, including marking, storage in locked containers, and IT system isolation.
• Transportation Security: Outlines secure shipping procedures for printers, both CONUS and OCONUS, requiring common carriers with tracking, bonded warehouses, and continuous surveillance.
• Reporting & Compliance: Requires contractors to appoint a security manager, report security incidents within 24 hours, and maintain detailed records.

This attachment is critical for bidders to understand the significant security obligations and potential costs associated with this opportunity. Compliance with these detailed security requirements, including obtaining necessary facility and personnel clearances, is mandatory for contract performance. Bidders must assess their ability to meet these stringent standards, which include background investigations, secure facility operations, and secure transportation protocols.

Form / Attachment / Pricing Sheet

This document, "Attachment B - CA Domestic Operational and Test Sites - Place of Delivery and Support," lists the various domestic operational and test sites for Consular Affairs (CA) Passport operations. It provides the names, symbols, and full addresses for each location.

• Passport and Center Operational Site Locations: A comprehensive list of passport agencies and centers across the United States and Puerto Rico.
• Site Details: For each location, the document includes the full name, a symbol (e.g., APC, AT, BN), and the street address, including suite numbers and specific entry instructions where applicable.
• Specialized Sites: Includes locations for Special Issuance Agency (SIA), Washington D.C. Integration Test Centers (CST), Independent Verification & Validation (IV&V), Consular System Modernization (CSM), and Passport Document Design (PPT/DD).
• Other Authorized User Locations: A section indicating potential other authorized user locations, though no specific sites are listed under this heading.

This attachment is crucial for bidders to understand the geographical distribution of Consular Affairs' passport operations. It specifies the physical locations where services may be delivered or support may be required. Bidders should review this list to determine if their proposed solution or service delivery model aligns with these operational sites, particularly if the opportunity involves on-site support, delivery of goods, or testing at these specific locations.

Form / Attachment / Pricing Sheet

This document is a DD Form 254, Contract Security Classification Specification. It outlines the security requirements for a contract, including required clearance levels, safeguarding of classified information, and personnel security requirements. It is used to communicate security requirements to contractors and subcontractors.

• Clearance and Safeguarding: Specifies the required level of facility security clearance (Top Secret) and safeguarding for classified information (None).
• Contract Information: Includes solicitation number (19AQMM-24-R-0113), due date (20240711), and indicates it is an original specification dated 20240612.
• Contractor and Performance Location: Identifies the Department of State locations as the actual performance site and lists "19AQMM" as the CAGE code for this location.
• General Unclassified Description: Describes the procurement as providing and supporting CA/CST NextGen Passport Personalization Printers at various Domestic Passport Sites and other locations.
• Access to Classified Information: Specifies that the contractor will NOT require access to classified information at their facility, nor will they receive, store, or generate classified information or material. However, it notes that MRPTs are authorized and connectivity to the Department of State computer system is required.
• Security Guidance: Outlines that contractor personnel must possess a TOP SECRET or SECRET clearance issued by DCSA prior to performance. A Moderate Risk Public Trust (MRPT) determination is also required for designated personnel. It details procedures for Visit Authorization Requests (VARs) and requirements for proposed subcontractors.

This document is critical for bidders to understand the security clearance and personnel background investigation requirements necessary for contract performance. It clarifies that while the contractor's facility will not handle classified information, personnel assigned to the contract must meet specific clearance levels and undergo background checks. Bidders must ensure their organization and personnel can meet these security stipulations.

Form / Attachment / Pricing Sheet

This document is a template for the CST Contract Status Report (CSR), which contractors are required to submit. It outlines the required sections and information for reporting on contract performance, financials, risks, and milestones.

• Contractor Details: Information about the prime contractor, project manager, and subcontractors.
• Reporting Period & Submission: Specifies the reporting period and submission deadline (3rd Thursday of the month).
• CSR Deck & Workbook: Requires submission of a signed CSR deck and an MS Excel Workbook containing:
  • Monthly Budget Data
  • Contract Modification History
  • Risk/Issue Log
  • FTE Chart
  • Milestone Reporting
• Instructions for Sections: Detailed guidance on how to complete each section, including:
  • Contract Scope
  • Requests for Government Action
  • Invoices
  • Other Direct Costs (ODCs)
  • Full-Time Equivalents (FTEs)
  • Contract Financials Overview
  • Monthly Budget Calculations
  • Contract Modification History
  • Risks and Issue Log
  • Milestone Reporting
  • Key Accomplishments
• Data Requirements: Data must be up-to-date as of the previous month's last business day.

This template is crucial for any bidder or contractor involved with the CST contract. It details the mandatory reporting requirements, submission procedures, and the specific data points that must be provided. Understanding this template is essential for accurate and timely proposal preparation and ongoing contract performance reporting.

Form / Attachment / Pricing Sheet

This document, "Attachment A - Pricing Table.xlsx", provides a detailed breakdown of estimated costs for the Next Generation Passport (NGP) project across various CLINs (Contract Line Item Numbers) and performance periods (Base Year and four Option Years). It serves as an Independent Government Cost Estimate (IGCE) and outlines proposed labor categories and associated rates.

• Cost Estimates by CLIN: Details costs for CLINs such as Transition, Program Management Support, High/Low Capacity Printers, Shipping, Installation, Integration, Training, Warranties, Consumables, Enhancement Software, Labor Categories, Vendor Support Sites, Relocation, Travel, and Decommissioning.
• Cost Basis Assumptions: Estimates are based on 1,920 hours per FTE, using vendor T&M labor rates, with a 12-month base period and four 12-month option periods. Escalation rates of 3% and 5% are applied to different CLINs.
• Labor Categories: Lists proposed labor categories and their corresponding contract labor categories, including roles like Program Manager, Cloud Engineer, Software Architect, and various analyst and developer positions.
• Revision History: Tracks changes made to the IGCE, including revisions for new print centers, development labor, and the inclusion of optional CLINs for BMOne Printers.

This pricing table is crucial for bidders to understand the government's cost expectations for the NGP opportunity. It provides insight into the anticipated labor mix, associated rates, and the estimated costs for hardware, software, services, and other project-related expenses across the contract's lifecycle. Bidders should use this information to inform their own pricing strategies and ensure their proposals are competitive and aligned with the government's budget.

Form / Attachment / Pricing Sheet

This document contains two Excel worksheets: a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire and a Software Producer Attestation Form. Both are intended to be completed by vendors responding to an opportunity.

C-SCRM Questionnaire:

• Requires vendor responses on company contact information (POC name, title, phone, email).
• Asks about the vendor's risk management plan, including identification of supply chain threats, mapping suppliers to threats, policies for checking SAM.gov exclusion records, and contractual SCRM requirements.
• Inquires about physical and personnel security, including background check policies, procedures to prevent tampering of ICT equipment, and insider threat literacy training.

Software Producer Attestation Form:

• Requires completion by each software producer supplying critical software.
• Asks for attestation to following NIST SP 800-218 secure software development practices and tasks.
• Requires identification of specific software products covered by the attestation.
• If unable to attest to all practices, vendors must describe mitigation practices and provide a Plan of Action & Milestones (POA&M).

Vendors must complete these forms as part of their offer. The C-SCRM Questionnaire assesses the vendor's overall supply chain risk management practices. The Software Producer Attestation Form is critical if the vendor or its subcontractors are providing "critical software" as defined by NIST, requiring adherence to secure software development standards. Failure to complete these forms accurately may impact the offer.

Form / Attachment / Pricing Sheet

This document outlines the "DOS Connectivity Requirements" for contractors working with the Department of State (DOS) network. It details security, configuration, and personnel requirements necessary for establishing and maintaining a connection to the DOS network, specifically referencing OpenNet.

• Responsibility: Identifies DOS Sponsoring Bureau, DS/CTS/CMO, and DS/IS/IND as responsible parties.
• Personnel Security: Requires personnel to meet security requirements, including Moderate Risk Public Trust certification, and restricts access for individuals from certain designated countries.
• Facility Security: Mandates that contractor facilities must be secured according to DOS standards.
• IT Configuration: Specifies that all hardware and software must be IT-CCB or local CCB approved and configured according to 12 FAM 620 and other DOS guidelines. Links to relevant documents are provided.
• Network Restrictions: States that the DOS network extension will have no other network connections.
• Equipment Security: Requires network equipment to be secured against tampering, either in an approved server room or an enclosure with a DS-approved lock.
• Auditing and Compliance: Notes that the connection is subject to on-site and remote auditing, scanning, and testing.
• Media Handling: Outlines requirements for returning or handling media used on DOS network systems.
• Incident Reporting: Details procedures for reporting security incidents.
• Approvals and Extensions: Specifies that network approval is valid for one year and requires annual extensions. Changes to configuration or physical space require prior approval.

This document is critical for any bidder whose opportunity involves connecting to or working within the Department of State's network infrastructure. It outlines mandatory security protocols, personnel clearances, and facility requirements that must be met to perform the contract. Failure to comply can lead to termination of the connection. Bidders should carefully review these requirements to assess their ability to meet them and to factor any associated costs or efforts into their proposals.