FY 2026 Preventive Maintenance Services to the Building Automation System

This federal solicitation (RFQ number 19GB5026Q0022) is issued by the U.S. Embassy in Libreville, Gabon, requesting quotations for Building Automation System (BAS) Preventative Maintenance (PM) services. The U.S. Government intends to award a single, firm-fixed-price purchase order to the responsible company offering the lowest acceptable price. The contract consists of a one-year base period and four subsequent one-year option periods, with an additional six-month option per FAR 52.217-8. The scope of work requires a certified contractor to perform two semi-annual site visits per year to service and maintain the embassy’s Johnson Controls Metasys systems. PM services encompass checking the communication network, validating time schedules, troubleshooting, configuring trends/alarms, performing backups, and conducting point-to-point checkouts and sensor calibrations. To be considered for the award, offerors must submit their electronic proposals in English by September 14, 2026, at 13:00 local time. The proposal package must include SF-1449, Section I pricing, Section 5 representations and certifications, proof of active System for Award Management (SAM) registration, a cybersecurity supply chain risk questionnaire, and a DD Form 254. Because certain systems are located within Controlled Access Areas (CAAs), the contractor must possess and maintain a DCSA Secret facility clearance, and personnel requiring secure access must hold a Top Secret security clearance. Value Added Tax (VAT) is not applicable to this contract.

This document is Amendment 0001 to Solicitation 19GB5026Q0022, issued by the American Embassy Libreville in Gabon. The sole purpose of this amendment, effective September 11, 2026, is to extend the offer due date. Proposals are now due by September 21, 2026, at 10:00 a.m. local time in Libreville. All other terms, conditions, and provisions of the original solicitation remain unchanged. Offerors are required to sign and return copies of this amendment to acknowledge receipt prior to the submission deadline.

This document provides instructions and the template for the Department of State's Secure Software Development Attestation Form (OMB No. 10670-0052). Pursuant to Executive Order 14028 and OMB Memoranda M-22-18 and M-23-16, federal agencies must obtain secure software development assurances from vendors before utilizing their software. The attestation requirement applies to software developed or majorly modified after September 14, 2022, as well as products delivered via continuous deployment (such as SaaS). It excludes software developed by federal agencies, freely obtained open-source software, incorporated third-party components, and publicly available free software. To comply, a software producer’s CEO or authorized designee must sign the form, attesting that the software was developed in secure environments using practices aligned with the NIST Secure Software Development Framework (SSDF). Alternatively, producers can demonstrate compliance by submitting an assessment from a certified FedRAMP Third Party Assessor Organization (3PAO). The form is divided into three sections: Section I identifies the attestation type and product details; Section II collects producer and contact information; and Section III contains the specific security attestations. These security practices include securing development environments, maintaining trusted source-code supply chains, tracking provenance, and employing automated vulnerability scanning. Failure to submit this form or provide a valid Plan of Action and Milestones (POA&M) may prevent agencies from using the vendor's software. Additionally, willfully providing false information is subject to criminal prosecution.

This document is a federal Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire designed for procurement vendors to assess and report their supply chain security practices. Offering entities, including joint ventures, must complete the questionnaire to provide contact information, detail their vendor risk management plans, and outline physical and personnel security protocols. The questionnaire requires vendors to self-report on key supply chain risk indicators, mapped to specific NIST SP 800-53 security controls. Key areas of inquiry include whether the vendor identifies and maps key suppliers to supply chain threats, maintains written SCRM requirements in supplier contracts, and verifies supplier compliance through contractual terms. Additionally, the questionnaire assesses physical and personnel security measures, asking vendors to verify their policies for conducting employee background checks, preventing tampering of stored Information and Communications Technology (ICT) equipment, and providing literacy training on insider threat indicators. The government reserves the right to request documentation to validate all vendor responses.