SCADA Systems Maintenance

SOURCES SOUGHT NOTICE

U.S. International Boundary and Water Commission

SCADA Systems Maintenance

Notice Number: FY26R1221102

THIS IS A SOURCES SOUGHT ANNOUNCEMENT ONLY.

This notice does not constitute a solicitation, request for proposal, request for quote, invitation for bid, or commitment by the Government. No award will be made from this Sources Sought notice. The Government is not requesting pricing at this time.

All information submitted in response to this announcement is voluntary. The Government will not pay for any information submitted, nor will it reimburse any respondent for costs incurred in preparing or submitting a response.

The United States Section of the International Boundary and Water Commission, USIBWC, is conducting market research to identify qualified firms capable of providing SCADA systems maintenance, cybersecurity support, vulnerability remediation, emergency troubleshooting, and system improvement services for USIBWC SCADA environments.

The purpose of this Sources Sought notice is to determine whether capable firms exist to perform the requirement and to assist the Government in determining the appropriate acquisition strategy, including whether the requirement should be set aside for small business or issued using full and open competition.

No solicitation is currently available. Interested parties should not request a copy of the solicitation. Any future solicitation will be posted separately, and interested parties will be required to respond separately to that solicitation.

Response to this notice is voluntary. However, information received in response to this Sources Sought notice may influence the Government’s acquisition strategy.

GENERAL INFORMATION

NAICS Code: 541512

NAICS Description: Computer Systems Design Services

Size Standard: $34.0 M

PSC: DJ01

Anticipated Contract Type: Firm Fixed Price

Place of Performance: Nogales, Arizona, with optional support at San Ysidro, California, if exercised by the Contracting Officer

Anticipated Period of Performance: One base year, with three option years anticipated

BACKGROUND

USIBWC operates SCADA systems that support critical wastewater treatment operations along the United States and Mexico border. The Nogales SCADA system is independent from the USIBWC Headquarters General Support System and supports mission critical wastewater treatment operations.

The required services include SCADA system maintenance, software and firmware patching, vulnerability remediation, software upgrades, replacement of parts and components, cybersecurity control assessment support, Risk Management Framework support, emergency troubleshooting, system documentation, and improvements to system functionality through existing SCADA software platforms.

Existing software and systems may include Rockwell RSLogix, Ignition, VMware ESXI, Rockwell ThinManager, FactoryTalk ME, Windows operating systems, Linux operating systems, Cisco network equipment, and related operational technology assets.

The Government seeks firms with demonstrated experience supporting SCADA systems in wastewater treatment environments, industrial control systems, cybersecurity compliance, vulnerability management, RMF support, and emergency maintenance for critical infrastructure.

SPECIFIC REQUIREMENTS

USIBWC requires contractor support for SCADA systems maintenance and improvements. The anticipated work includes, but is not limited to, the following:

1. Provide predictive, preventive, and timely maintenance for SCADA systems.
2. Support SCADA system software, firmware, patching, upgrades, and remediation.
3. Support vulnerability management and provide documented evidence of remediation actions.
4. Support RMF documentation and continuous monitoring activities.
5. Provide monthly vulnerability and patching reports.
6. Provide monthly RMF and cybersecurity status reports.
7. Provide biweekly project status reports.
8. Provide incident response reports within three business days after each incident.
9. Maintain and update network diagrams, asset inventories, configuration baselines, hardware lists, and software lists.
10. Provide remote troubleshooting support within four hours of notification.
11. Provide emergency onsite troubleshooting, upgrades, or repairs within seventy two hours when the issue cannot be resolved remotely.
12. Support SCADA and OT project management initiatives.
13. Review designs, proposals, bills of material, SCADA integration plans, risk assessments, and project documentation.
14. Provide technical recommendations on SCADA standards, system improvements, project planning, and integration strategies.
15. Support annual SCADA and OT system audits and provide findings and recommendations.
16. Address critical, high, moderate, and low vulnerabilities according to required remediation timelines.
17. Support Nogales SCADA requirements as the base requirement.
18. Support San Ysidro SCADA requirements only if the Government formally exercises and funds the optional CLIN.

The Contractor shall not make final determinations regarding system authorization, risk acceptance, agency policy, approval of standards, or issuance of an Authorization to Operate. All final decisions remain with the Government.

CONTRACTOR CAPABILITY AREAS

Interested firms should demonstrate experience and capability in the following areas:

1. SCADA systems within wastewater treatment plants.
2. Wastewater treatment processes and operations.
3. Ignition SCADA software, version Gold 8 or newer, or equivalent current certification.
4. Rockwell systems and Rockwell software support.
5. Cisco network equipment management, configuration, patching, and troubleshooting.
6. VMware vCenter and VMware ESXI administration.
7. Active Directory, DNS, DHCP, PKI, and Group Policy management.
8. Fiber networks, firewall management, VLAN creation, network segmentation, and SCADA network protection.
9. Java, Python, and SQL programming.
10. Legacy PLC migration in wastewater treatment environments.
11. SCADA and OT cybersecurity.
12. FISMA, NIST, CISA, HVA overlays, and RMF support.
13. Vulnerability management, patching, remediation, and evidence documentation.
14. Incident response, emergency troubleshooting, and onsite support.
15. Support for critical infrastructure and industrial control systems.
16. Work involving Controlled Unclassified Information, cybersecurity safeguards, and Federal information security requirements.

PERSONNEL AND SECURITY REQUIREMENTS

Interested firms must address whether proposed personnel can meet the security requirements needed to access USIBWC facilities, systems, and SCADA components.

Personnel requiring administrator privileges to SCADA system components, appliances, hardware, operating systems, or applications must possess a favorably adjudicated Tier 4 suitability level background investigation or equivalent background investigation before award, as required by the Government.

Personnel requiring access to programming code or field devices, without administrator privileges, must meet the applicable suitability requirements before performing work.

All contractor personnel and subcontractor personnel requiring access to the systems must be United States citizens.

SUBMISSION INSTRUCTIONS

Interested firms shall submit responses by email to:

Suzette Smith
Contract Specialist
suzette.smith@ibwc.gov

[Insert Secondary Point of Contact, if applicable]

Subject Line: Sources Sought Response, SCADA Systems Maintenance and Improvements, [Insert Notice Number]

Responses are due no later than June 22, 2026 3pm MDT.

Late responses may not be considered for market research purposes.

Responses shall be submitted by email only. Responses should be complete and sufficiently detailed to allow the Government to assess the firm’s capability to perform the full requirement.

The Government is not requesting pricing with this Sources Sought response.

RESPONSE REQUIREMENTS

Interested firms shall provide the following information:

1. Company Information

a. Company name.

b. Company address.

c. Unique Entity Identifier, UEI.

d. CAGE Code.

e. Point of contact name, title, phone number, and email address.

f. Company website, if available.

g. SAM.gov registration status.

1. Business Size and Socioeconomic Status

Identify the firm’s business size and socioeconomic status under the applicable NAICS code.

Include all applicable categories:

a. Small Business.

b. 8(a) Small Business.

c. HUBZone Small Business.

d. Woman Owned Small Business.

e. Economically Disadvantaged Woman Owned Small Business.

f. Service Disabled Veteran Owned Small Business.

g. Veteran Owned Small Business.

h. Small Disadvantaged Business.

The business size and socioeconomic status must be consistent with the firm’s SAM.gov registration.

1. Relevant Experience

Provide at least three examples of projects completed within the past seven years that demonstrate experience with similar work.

For each project, include:

a. Project title.

b. Project location.

c. Customer or agency.

d. Contract number, if applicable.

e. Contract value.

f. Period of performance.

g. Prime contractor or subcontractor role.

h. Brief description of work performed.

i. Point of contact for the owner or customer, including phone number and email address.

Relevant experience should address SCADA systems, wastewater treatment facilities, industrial control systems, OT cybersecurity, vulnerability remediation, RMF support, emergency troubleshooting, and system maintenance.

1. Technical Capability

Provide a narrative explaining the firm’s capability to perform the full requirement. The response should address the firm’s experience and available resources in the following areas:

a. SCADA system maintenance and improvements.

b. Wastewater treatment plant SCADA support.

c. Ignition SCADA software.

d. Rockwell software and PLC support.

e. Cisco network equipment.

f. VMware environments.

g. Windows domain administration.

h. SCADA network segmentation and firewall support.

i. Vulnerability management and patching.

j. RMF documentation and continuous monitoring support.

k. FISMA, NIST, CISA, and HVA compliance support.

l. Emergency remote and onsite troubleshooting.

m. Legacy PLC migration.

n. SCADA documentation, asset inventories, network diagrams, and configuration baselines.

1. Certifications and Credentials

Identify relevant certifications and credentials held by the firm or proposed personnel, including but not limited to:

a. Ignition Gold 8 or newer certification.

b. Inductive Automation Integrator listing.

c. CCNA certification.

d. Rockwell Solutions Provider credentials.

e. VMware Certified Professional or equivalent experience.

f. Cybersecurity, RMF, or industrial control system certifications.

1. Personnel and Staffing

Describe the firm’s available personnel and staffing approach for this requirement.

At a minimum, address:

a. Key personnel.

b. SCADA engineers.

c. OT cybersecurity personnel.

d. Network personnel.

e. VMware personnel.

f. Windows domain personnel.

g. RMF and cybersecurity documentation personnel.

h. Emergency support personnel.

i. Availability for on call support during Mountain Standard Time daytime hours, Monday through Friday.

1. Prime Contractor Capability

State whether the firm intends to perform as a prime contractor or subcontractor.

If the firm intends to perform as a prime contractor, identify which portions of the work the firm expects to self perform and which portions may be subcontracted.

If the firm intends to perform as a subcontractor, identify the specific portions of work the firm is capable of performing.

1. Teaming or Joint Venture Information

If the firm anticipates using a teaming arrangement or joint venture, provide the names and roles of proposed team members, if known.

The response should explain how the team collectively meets the specialized requirements of the project.

1. Interest in Microsoft Teams Requirements Meeting

Interested firms shall state whether they are interested in attending a Microsoft Teams meeting to obtain a general understanding of the requirements posted in this Sources Sought notice.

Firms interested in attending the meeting shall include the following information in their response:

a. Company name.

b. Point of contact name.

c. Point of contact email address.

d. Point of contact phone number.

e. Names and email addresses of proposed attendees.

f. Confirmation that the firm submitted a capability response to this Sources Sought notice.

MICROSOFT TEAMS MEETING INFORMATION

USIBWC may hold one Microsoft Teams meeting for firms that submit a response to this Sources Sought notice and indicate interest in attending. The purpose of the meeting is to provide interested firms with a general understanding of the requirements posted in this Sources Sought notice.

The meeting will be held by invitation only. Invitations will be sent only to firms that submit a timely response and indicate interest in attending.

The meeting will be recorded. The recording and any general information provided during the meeting may be made available after the meeting.

No one on one meetings will be held. No private discussions will occur. The Government will not provide source selection information, procurement sensitive information, or information that gives one vendor an unfair competitive advantage.

Vendors shall not submit pricing during the meeting. The Government will not evaluate vendors during the meeting. Attendance at the meeting is voluntary and is not required to respond to any future solicitation.

If no firms submit a response indicating interest in attending the Microsoft Teams meeting, no meeting will be scheduled and no meeting notice or recording will be published.

QUESTIONS

Questions regarding this Sources Sought notice shall be submitted in writing by email to the Contract Specialist listed above.

The Government may or may not respond to questions received in response to this Sources Sought notice. Any Government response that affects the requirement or market research notice may be posted publicly.

IMPORTANT INFORMATION

Responses that only identify general IT experience, without addressing the specialized SCADA, wastewater treatment, OT cybersecurity, RMF, vulnerability remediation, and emergency support areas listed above, may not provide sufficient information for the Government to determine capability for this requirement.

This notice is for market research and planning purposes only.

All future notices, if any, will be posted separately on SAM.gov.