RFQ 19PE5026Q0019 - Lima VNET Contract

Form / Attachment / Pricing Sheet

This document contains two primary components: a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire and a C-SCRM Software Producer Attestation Form. Both are designed to gather information from vendors regarding their C-SCRM practices and their adherence to secure software development standards.

C-SCRM Questionnaire:

• Contact Information: Requires vendor company name and primary Point-of-Contact (POC) details.
• Vendor Risk Management Plan: Asks about the identification of supply chain threats, mapping of suppliers to threats, policies for checking SAM.gov exclusion records, written C-SCRM requirements in contracts, and verification of supplier compliance.
• Physical and Personnel Security: Inquires about background check policies, procedures to prevent tampering of ICT equipment, and insider threat awareness training.

C-SCRM Software Producer Attestation Form:

• Requires the software producer to attest to following secure development practices and tasks outlined in NIST SP 800-218.
• If full attestation is not possible, vendors must identify non-compliant practices and provide a Plan of Action & Milestones (POA&M) for mitigation.
• Requires a description of the software products the attestation applies to.
• Includes detailed tables outlining NIST SP 800-218 practices and tasks related to secure software development, such as defining security requirements, implementing roles and responsibilities, using secure toolchains, reviewing designs, reusing secure code, secure coding practices, build process security, code review, executable testing, and secure default configurations.

Vendors are required to complete and submit these forms to demonstrate their commitment to and implementation of cybersecurity supply chain risk management and secure software development practices, as specified by NIST standards. This information is crucial for assessing vendor risk and compliance.

Solicitation / RFP / RFQ

This Request for Quotations (RFQ) seeks proposals for Virtual Net (VNET) service for the U.S. Embassy in Lima, Peru. The government intends to award a contract based on initial quotations.

• A dedicated symmetrical internet channel with a bandwidth of 140 Mbps.

• 24/7/365 immediate maintenance and service support within two hours of request.

• Services must be provided in accordance with the attached Statement of Work and related documents.

• Specific equipment requirements include Cisco Catalyst 9200 Series switches and Cisco routers.

• The service must be "always on" and not require custom software installation on the client side.

• Detailed network topology maps are required.

• Cybersecurity Supply Chain Risk Management (C-SCRM) requirements, including a questionnaire and attestation form, must be met.

• The contract will have a one-year base period with four (4) one-year option periods.

• The contract type will be Firm Fixed Price (FFP).

• Value Added Tax (VAT) will be priced as a separate line item.

• Proposals must be submitted electronically via email in a single PDF file to Mendezj@state.gov by June 1, 2026, before 11:00 a.m. local time.

• Key submission documents include SF-1449, Section 1 (Prices), Section 3 (Additional Information including C-SCRM forms), and Section 5 (Representations and Certifications).

• A pre-proposal conference will be held on May 18, 2026, at 10:00 a.m. at the US Embassy Lima. RSVP by May 15, 2026.

• Evaluation will be based on FAR 13 Comparative Evaluation, considering technical, past performance, and price. A C-SCRM Go/No-Go factor will be applied.

• The acquisition is unrestricted.

• Offerors must have an active SAM registration or NCAGE code.

• Offerors must provide proof of operating an established business in Peru.

• Incomplete proposals will not be considered.

• No quotations will be accepted after the due date and time.