DA10-- Enterprise Vulnerability Management Maintenance and Support (VA-26-00048094)

Solicitation / RFP / RFQ

This document describes the Department of Veterans Affairs (VA) Office of Information and Technology's (OIT) requirement for an enterprise vulnerability management capability. The goal is to support authoritative vulnerability scanning, compliance scanning, authenticated endpoint visibility, vulnerability reporting, and operational support for the VA Cybersecurity Operations Center (CSOC) Vulnerability Scanning Services (VSS).

• The requirement can be met by maintaining the existing Tenable Security Center product family or by proposing a new commercial vulnerability management solution.

• The solution must support approximately 1.8 million IPs and associated assets across distributed environments and datacenters.

• Centralized management, distributed scanning, role-based administration, dashboarding, reporting, and data export are required.

• Support for approximately 675,000 FedRAMP Moderate agents or an equivalent for authenticated endpoint visibility is needed.

• The capability must support ad hoc and emergency vulnerability scans for emergent threats and external oversight requests.

• Reporting outputs must support CSOC, VSS, ATO, SCA, CRD, PCI, OIG remediation, and enterprise risk reporting.

• The solution must remain current, patched, supported, secure, accessible, and operational throughout the period of performance.

• The document outlines a base year (7/1/2026-6/30/2027) and four option years.

• It details specific Tenable Security Center maintenance renewal items, including support, consoles, scanners, and cloud agents.

• Offerors must clearly state whether they propose to maintain the existing architecture, provide a new commercial capability, or offer a hybrid/transition approach.

• VA will evaluate different technical approaches against the same required operational outcomes and minimum salient characteristics.

• Offerors must provide sufficient detail for VA to compare risk, continuity, transition impact, lifecycle cost, supportability, and mission fit.

• Continuity of operations is critical; no gap in scanning, reporting, or response capabilities will be accepted.

• Not explicitly stated in this document, but the acquisition is described as "open-specification."

• The document includes detailed information on Section 508 accessibility requirements and compliance.

• It also specifies requirements for Internet Protocol Version 6 (IPv6) support and Social Security Number (SSN) reduction.

• Information security considerations, including a current VA A&A/ATO package, are mentioned.

Request for Information (RFI)

This RFI is issued by the Department of Veterans Affairs (VA) Technology Acquisition Center (TAC) for market research purposes. The VA is seeking information to develop an acquisition strategy for a proposed Firm Fixed Priced Task Order for Enterprise Vulnerability Management Maintenance and Support. This RFI is NOT a Request for Quote (RFQ) or a guarantee that an RFQ will be issued. No quotes or proposals will be accepted at this time.

Respondents are requested to provide:

A. General Company Information:

• Company Name, CAGE/DUNS Number, Address, Point of Contact, Telephone, Email Address
• GWAC Contract Number (if applicable)
• Socio-economic size under NAICS Code 541519 (specifically for SDVOSB/VOSB, confirm certification in VIP database)
• Questions or recommended changes to the attached draft Product Description.

B. Capability Statement:

• A brief statement describing your company's ability to meet the requirements in the draft Product Description.

• Confirmation of Section 508 compliance and a current VPAT/ACR. If gaps exist, note them and the remediation timeline.

• Responses must be no more than 10 pages and 5 MB.

• Mark responses as "Proprietary Information" if business sensitive.

• NO MARKETING MATERIALS ARE ALLOWED.

• Submit responses via email to Joshua McGarry (Joshua.McGarry@va.gov) by June 4, 2026, 11:00 AM ET.

• Response Date/Time: June 4, 2026, 11:00 AM Eastern Time, New York, USA

• Solicitation Number: 36C10B26Q0482

• NAICS Code: 541519

• Product Service Code: DA10

• Contracting Office: Department of Veterans Affairs, Technology Acquisition Center, Eatontown NJ 07724

• The VA reserves the right to not respond to any, all, or select responses.

• All requirements are subject to change.

• See attached draft Product Description: PD_DRAFT_Enterprise_Vulnerability_Management_Open_Spec_5_28_26.