Next-Generation Network Security Firewall Rental Service

Amendment / Modification

This Amendment 0001 to Solicitation 19TH2026Q0014, dated February 2, 2026, introduces two new criteria to paragraph A.3. under Section 3 - Solicitation Provisions. The deadline for receipt of offers is not extended.

• Section 3 - Solicitation Provisions, Paragraph A.3. is updated with the following:
  • Criterion (15): Requires evidence that the offeror has a working system of firewall solution survivability in case of emergencies and serious disaster when parts of the firewall solution are destroyed.
  • Criterion (16): Requires evidence that the offeror can provide 24x7 onsite/remote software support, including software version updates and patches, for the duration of the rental agreement period.

Potential bidders must now address these two new criteria in their proposals. All other terms and conditions of the solicitation remain unchanged, and the offer submission deadline has not been extended.

Solicitation / RFP / RFQ

This Request for Quotations (RFQ) seeks proposals for a Next-Generation Network Security Firewall rental service, including support, security subscriptions, and software subscriptions. The U.S. government intends to award a purchase order to the responsible offeror representing the best value, determined through a comparative evaluation process (not LPTA or trade-off). The goal is to replace the existing firewall with a new solution that ensures continued and enhanced protection against evolving cybersecurity threats.

• Service: 36-month rental agreement for an enterprise-grade next-generation network security firewall solution.

• Equipment: Must include redundant power components for high availability. Ownership remains with the contractor.

• Architecture: Must utilize a single-pass or unified traffic inspection architecture.

• Security Subscriptions: Advanced threat prevention, malware analysis/sandboxing, URL/web content filtering, DNS-based security, and secure connectivity/traffic optimization.

• Implementation: Migrate existing configurations, policies, and rules without disrupting network operations. Must comply with WRAIR-AFRIMS IDS STIGs and applicable cybersecurity policies.

• Support: 24x7 technical support for incident response and troubleshooting, including four (4) onsite incidents and hardware maintenance/replacement.

• Deliverables: Deployed firewall solution, active security subscriptions, successful migration, compliant system, 24x7 technical support, continuous hardware maintenance, and configuration/implementation documentation.

• Contract Type: Firm fixed price.

• Period of Performance: Contract starts February 26, 2026, for a 36-month rental period.

• Pricing: All prices in Thai Baht. Value Added Tax (VAT) is not applicable.

• Questions Due: February 4, 2026, 12:00 PM (Bangkok local time).

• Quotations Due: February 12, 2026, 04:00 PM (Bangkok local time).

• Submission Method: Electronically to BangkokGSOProcurement@state.gov in Adobe Acrobat (pdf) format. File size must not exceed 25MB per email.

• Required Forms: SF-1449, Section 1 (Pricing), Section 5 (Representations and Certifications), and Attachment 1 (Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire).

• Evaluation: Comparative evaluation based on technical, past performance, and price. Offers must meet basic responsibility standards and pass a C-SCRM Go/No-Go review.

• The acquisition is unrestricted.

• Offerors must demonstrate established business presence in Thailand and provide relevant experience.

• The specific firewall solution approved is Palo Alto Networks PA-3410 with associated support and subscription services.

• Offerors must be authorized distributors or partners of Palo Alto products.

• Past performance will be evaluated, and the government may discuss past performance with client contacts.

Form / Attachment / Pricing Sheet

This document is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire that vendors must complete as part of their offer submission. It requires vendors to provide information regarding their organization's C-SCRM practices and personnel security measures.

Section 1 - Contact Information: Requires vendor's company name, primary Point-of-Contact (POC) name, job title, phone number, and email address.

Section 2 - Vendor Risk Management Plan: Asks about the vendor's practices for identifying supply chain threats, mapping suppliers to these threats, and having written C-SCRM requirements in contracts with key suppliers. It also inquires about verifying supplier compliance with C-SCRM requirements. (Note: If the vendor has no suppliers, they should answer 'Yes' to these questions).

Section 3 - Physical and Personnel Security: Inquires about the vendor's policies for employee background checks, procedures to prevent tampering of Information and Communications Technology (ICT) equipment in supply chain inventory, and training provided on recognizing and reporting insider threats.

Vendors must complete this questionnaire accurately and provide responses in the designated 'Vendor Response' column. The government may request documentation to validate these responses. Failure to provide complete and accurate information may impact the evaluation of the offer.