DA10--Alternative to BigFix Endpoint Management (VA-26-00012805)

Solicitation / RFP / RFQ

This document provides an update on the acquisition strategy for an "Alternative to BigFix Endpoint Management" (VA-26-00012805). The government intends to issue a Request for Quotation (RFQ) 36C10B26Q0308 through the NASA Solutions for Enterprise-Wide Procurement (SEWP) Government-Wide Acquisition Contract (GWAC).

Not detailed in this specific notification, but it pertains to an alternative to BigFix Endpoint Management.

To be issued via NASA SEWP GWAC.

Details for submission and evaluation will be provided in the upcoming RFQ.

This acquisition will be a Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside on NASA SEWP. The government has determined that multiple (two or more) SDVOSBs are capable of providing the required products under the NASA SEWP contract.

The government is targeting the posting of the solicitation in the week of May 11, 2026. The response date for this opportunity is May 6, 2026, 10:00 AM Eastern Time.

Amendment / Modification

• The response date for Sources Sought Notice number 36C10B26Q0019 has been extended.

• The new response deadline is October 6, 2025, at 4:00 PM Eastern Time, New York, USA.

• The previous deadline was October 2, 2025, at 4:00 PM EST.

• Response Date/Time/Zone

• Bidders now have until October 6, 2025, at 4:00 PM EST to submit their responses via email to Angel Santos (Angel.Santos2@va.gov) and Kendra Casebolt (Kendra.Casebolt@va.gov).

• Responses should include "RFI# 36C10B26Q0019" in the subject line.

Request for Information (RFI)

This RFI is issued by the Department of Veterans Affairs (VA) for market research purposes to identify alternative endpoint management solutions to the currently deployed HCL BigFix software. The VA is seeking products that can meet or exceed the capabilities of the existing solution for managing approximately 150,000 clients/endpoints across on-premises, AWS, and Azure environments.

This RFI does not constitute a Request for Quote (RFQ) or Proposal (RFP) and does not commit the government to any future contract award. Responses will be used to develop acquisition strategies and Performance Work Statements (PWS).

The VA prioritizes the following capabilities for an alternative solution:

• Cross-OS Patch: Support for Windows Server, Linux, Solaris, and MacOS, with content available within 24 hours of release.
• Real-Time Compliance/Enforcement: Continuous monitoring and enforcement of compliance policies, including CDM for CCE and CVE.
• Offline/Air-Gapped Support: Full functionality for endpoints not always connected to the network.
• Third-Party Patch Catalog Depth: Extensive library for third-party application patches.
• Role-Based Control / Least Privilege: Implementation of granular access controls.
• Compliance Reporting: Detailed reports based on STIG, CIS, and USGCB standards, with customization support.
• Integration: Seamless integration with CMDB, SIEM, SOAR, Azure, AWS, and ServiceNow via API.
• Software Distribution: Management and deployment of applications and updates.
• Asset Discovery / Asset Management: Comprehensive inventory and cataloging of hardware and software assets.
• Vulnerability Correlation: Linking vulnerabilities with patch availability for prioritized remediation.
• Automation at Scale: Handling over 500,000 endpoints.
• Federal Compliance Posture: Adherence to FISMA and CDM mandates.

Interested parties should submit a capability statement (max 10 pages) addressing their ability to meet the requirements and answering specific questions detailed in the RFI. Responses must be emailed to Angel Santos (Angel.Santos2@va.gov) and Kendra Casebolt (Kendra.Casebolt@va.gov) by October 2, 2025, 4 PM EST. Please include "RFI# 36C10B26Q0019" in the subject line.

Respondents are asked to provide:

• Technical solution summary.

• Description of product and how it meets the 12 prioritized capabilities.

• Experience with enterprise-wide deployments.

• High-level Bill of Materials (BOM), licensing model (perpetual/subscription), and support details.

• Details on AI/ML capabilities.

• Information on managed services or SaaS offerings (including FEDRAMP certification).

• Rough Order of Magnitude (ROM) pricing.

• Company identification, business size, NAICS codes, and GSA/GWAC/SEWP schedules.

• Socioeconomic data and subcontracting compliance.

• Information on current or past similar services provided to government or commercial entities.

• Responses are voluntary and become government property.

• The government will not reimburse costs associated with responses.

• The VA may invite select responders for follow-up briefings.

• Potential future solicitations will be posted on SAM.gov.