Cell Phone Services for U.S. Embassy-Vilnius

Solicitation / RFP / RFQ

This document is a Request for Quotations (RFQ) for cell phone services. The U.S. Government intends to award a contract to the responsible offeror representing best value using a comparative evaluation process, not a low price technically acceptable (LPTA) or trade-off process. Basic standards for responsibility and solicitation compliance must be met for award.

• The solicitation requires cell phone services.

• Offerors must complete required portions of the attached document and submit to the address shown on Standard Form 1449.

• Specific required submission items include:

  • SF-1449
  • Section I, Pricing
  • Section 5 Representations and Certifications
  • Additional information as required in Section 3
  • Proof of SAM Registration
  • CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT C- SCRM Questionnaire and/or State Department Secure Software Development Attestation Form

• Not explicitly stated, but implies a contract award.

• A pre-quotation conference will be held via Microsoft Teams on January 15th, 2026, at 10:00. Contact Vilnius.Procurement@state.gov for an invitation by January 14th COB.

• Quotations are due by Friday, January 30th, 2026. Late or incomplete proposals will not be accepted.

• Quotations must be submitted electronically to Vilnius.Procurement@state.gov.

• Evaluation will be based on best value using comparative evaluation.

• Offerors must be registered in the SAM (System for Award Management) database prior to proposal submission. Failure to be registered may result in the proposal being considered non-responsible.

• Discussions may be held with companies if needed, but the award will be based on initial quotations.

• Proposals must be in English.

Form / Attachment / Pricing Sheet

This document is an Excel file containing two primary worksheets: 'C-SCRM Questionnaire' and 'Software Producer Attestation'. It is designed to collect information from vendors regarding Cybersecurity Supply Chain Risk Management (C-SCRM) practices and their adherence to secure software development standards.

C-SCRM Questionnaire:

• Section 1: Contact Information: Requires vendor company name and primary Point-of-Contact (POC) details (name, title, phone, email).
• Section 2: Vendor Risk Management Plan: Asks yes/no questions about the vendor's processes for identifying supply chain threats, mapping suppliers, checking SAM.gov exclusion records, and incorporating SCRM requirements into contracts.
• Section 3: Physical and Personnel Security: Asks yes/no questions regarding policies for background checks, preventing tampering of ICT equipment, and insider threat awareness training.

Software Producer Attestation:

• Requires the software producer to attest to following secure development practices and tasks as defined in NIST SP 800-218.
• If full attestation is not possible, vendors must identify non-compliant practices and provide a Plan of Action & Milestones (POA&M).
• Requires a description of the software product(s) to which the attestation applies.

Vendors must complete the 'C-SCRM Questionnaire' by providing responses in the shaded cells under column D. If the offer includes critical software, the 'Software Producer Attestation' worksheet must be completed by each software producer involved. Failure to provide accurate and complete information may impact the offer. The government may request documentation to validate responses.

Solicitation / RFP / RFQ

This solicitation seeks proposals for mobile telephone services for the U.S. Embassy in Vilnius, Lithuania. The services must be high-availability, secure, and comprehensive, supporting a fleet of U.S. Government-owned devices with a mixed hardware profile (eSIM-only and physical SIM). The target availability is 99.9%.

• Voice Services: Unlimited domestic calls within Lithuania, free intra-fleet calling, high-quality international connectivity (USA, EU, global), and standard features (call forwarding, blocking, waiting, conferencing, missed call alerts, English voicemail).

• Messaging Services: Unlimited domestic and international SMS, support for Two-Factor Authentication (OTP/2FA) via SMS, and SMS-based parking payments.

• Data Services: "Unlimited Data" for official use, provisioned on the highest commercial tier (5G/5G+). A Fair Use Policy (FUP) must be transparently stated, with a minimum throughput of 4 Mbps after throttling. Tethering/Personal Hotspot must be enabled without blocking. No blocking or censoring of internet content or VPNs.

• Data-Only Services: SIM cards for devices like hotspots, tablets, and laptops, priced separately.

• Roaming: "Roam Like at Home" for EU/EEA (deducted from domestic plan). A Flat-Rate Daily Pass for U.S. roaming is required (minimum 500 MB high-speed data per day before throttling); pay-per-MB billing is not authorized.

• Technical & Operational: Minimum 90% geographic coverage in Lithuania, 99.9% network uptime. Planned maintenance outage notification 24 hours in advance; unplanned outage notification within 1 hour. Support for both eSIM-only (US-market) and physical SIM (EU-market) devices. Ability to swap phone numbers between physical and eSIM within 2 business hours.

• Critical Stockpile: 10 unactivated physical SIM cards, 5 unactivated eSIM vouchers, and 10 spare SIM cards for on-site use.

• Mobile Identity: Support for Lithuanian Mobile-ID (M-parašas) on both physical and eSIM.

• Customer Support: 24/7 dedicated support line, direct routing to business/government customer service, and English language support.

• Web Portal: Secure portal for line activation/suspension, SIM swaps, and invoice access.

• Security: Compliance with NDAA Section 889 regarding covered telecommunications equipment and services.

• Contract Type: Indefinite Delivery/Indefinite Quantity (IDIQ).

• Period of Performance: One base year (March 1, 2026 - February 28, 2027) with four one-year options.

• Estimated Value: Not explicitly stated in the provided sections, but pricing is structured for base and option years.

• Submission Deadline: January 30, 2026, 17:00.

• Evaluation: Comparative evaluation based on Technical, Past Performance, and Price. Technical evaluation will assess quality superiority. A Cybersecurity Supply Chain Risk Management (C-SCRM) Go/No-Go factor is part of the preliminary evaluation.

• Key Deadlines: Pre-quotation conference on January 15, 2026, 10:00. Invitation request by January 14th COB.

• The solicitation does not explicitly state set-aside requirements in the provided sections, but includes numerous FAR clauses related to small business concerns, HUBZone, SDVOSB, EDWOSB, and WOSB programs.

• Offerors must complete the SF-1449 cover page and Sections 1 and 5. Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire and State Department Secure Software Development Attestation Form are required.

• Past performance information and references are required.

• Pricing must include all applicable taxes (including 21% VAT) and fees.