Microsoft 365 GCC Migration, Implementation, Configuration, Training and Support Services

This document presents a Questions and Answers (Q&A) clarification for Solicitation No. 19TH2026Q0077, issued by the U.S. Embassy in Bangkok, Thailand. The solicitation seeks a contractor to handle the migration, implementation, configuration, training, and support services for a transition to Microsoft 365 GCC High. Key technical details and requirements clarified in the document include: - **Environment & Licensing:** The migration affects approximately 460 users. The target environment is Microsoft 365 GCC High on the Defense Health Agency (DHA) tenant. Because the organization operates on a .org network, the contractor must purchase the necessary licensing as part of the quote. - **Migration Scope:** The project involves migrating 372 users, 186 groups, 2 resource mailboxes, 195 contacts, and 27 shared mailboxes from an on-premise Exchange Server 2016 environment. The total mailbox data size is 966.75 GB, supplemented by 363 MB of public folders. - **Device Management:** The contractor will manage approximately 150 corporate-owned iPhones currently using Apple Business Manager and DISA STIG policies via AirWatch MDM. - **Security & Staffing:** Security compliance must adhere to NIST 800-53, Risk Management Framework (RMF), and DISA DODI 8500.01 standards. Crucially, all delivery personnel granted administrative access must be U.S. citizens holding a Top Secret clearance. - **Execution & Support:** The project will follow a hybrid model, combining remote contractor delivery with on-site AFRIMS staff in Bangkok. Post-migration support requires 24/7 remote coverage for 12 months. The deadline for quotation submissions is confirmed as September 8, 2026, at 3:00 PM Bangkok time.

This Request for Quotations (RFQ), number 19TH2026Q0077, is issued by the U.S. Embassy in Bangkok, Thailand, on behalf of the WRAIR-AFRIMS department. The U.S. Government intends to award a firm-fixed-price purchase order to migrate and modernize its enterprise IT infrastructure. The primary objectives of this project are to replace the organization’s end-of-support Microsoft Exchange Server 2016 with Microsoft Office 365 Government Community Cloud (GCC) G3 services, migrate from VMware AirWatch to Microsoft Intune for Mobile Device Management (MDM), and implement Microsoft Entra ID Governance. The scope of work includes tenant configuration, secure user and mailbox migration, identity lifecycle management, multi-factor authentication (MFA), role-based access controls, and device enrollment. The contractor must also provide testing, validation, administrator training, comprehensive documentation, and a 30-day post-implementation warranty. Eligible offerors must be registered in the System for Award Management (SAM) database and submit their technical and pricing proposals in English. Submissions must include the SF-1449, pricing schedules, and a completed Cybersecurity Supply Chain Risk Management (C-SCRM) questionnaire. All implementation and migration activities must be completed within 12 months of the contract award. Clarifying questions are due by September 2, 2026, and final quotations must be submitted electronically by September 8, 2026, at 3:00 PM Bangkok time.

This document is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire designed for federal government vendors submitting procurement offers. Its primary purpose is to assess an offering organization's supply chain security posture, vendor risk management practices, and physical and personnel security protocols. The questionnaire is structured into three main sections: 1. Contact Information: Gathers basic organizational details and primary point-of-contact information. 2. Vendor Risk Management Plan: Assesses how the organization identifies supply chain threats, maps suppliers to those threats, and enforces written SCRM requirements through supplier contracts and verifications, mapped to NIST SP 800-53 standards. 3. Physical and Personnel Security: Evaluates the vendor's employee background check policies, insider threat literacy training, and procedures to prevent tampering of stored Information and Communications Technology (ICT) inventory. Completing this worksheet is mandatory for the prime offering entity (including joint ventures). The government reserves the right to request supporting documentation from vendors to validate all submitted responses.