DA10--Alternative to BigFix Endpoint Management (VA-26-00012805)

Solicitation / RFP / RFQ

This document provides notification regarding the acquisition strategy for an "Alternative to BigFix Endpoint Management" (VA-26-00012805). The government intends to issue a Request for Quotation (RFQ) 36C10B26Q0308.

Not detailed in this notification; this document outlines the acquisition strategy.

Not detailed in this notification.

• The RFQ will be issued on the NASA Solutions for Enterprise-Wide Procurement (SEWP) Government-Wide Acquisition Contract (GWAC).

• The government is targeting posting the solicitation in the week of May 11, 2026.

• The acquisition will be a Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside.

• The requirement has been found to be within the scope of NASA SEWP.

• Multiple (two or more) SDVOSBs are identified as prospective resellers of capable products under NASA SEWP.

• Solicitation Number: 36C10B26Q0142

• Contracting Office ZIP Code: 07724

• Response Date/Time/Zone: 05-06-2026 10am EASTERN TIME, NEW YORK, USA

• Product Service Code (PSC): DA10

• NAICS Code: 541519

• Contact: Angel Santos, Contract Specialist, Angel.Santos2@va.gov, 848-377-5096

Amendment / Modification

• The response date for Solicitation 36C10B26Q0142 has been extended.

• The new response date is February 5, 2026, at 10:00 AM Eastern Time, New York, USA.

• The previous response date was February 3, 2026, at 1:00 PM Eastern Time.

• Response Date/Time/Zone

• Bidders now have until February 5, 2026, 10:00 AM EST to submit their responses.

Performance Work Statement (PWS)

To procure an Enterprise Server Endpoint Management (ESEM) Software as a Service (SaaS) or Hybrid SaaS solution, including integration support and optional sustainment services, to enhance cybersecurity and manage endpoints across the Department of Veterans Affairs (VA).

• Implement and manage an ESEM SaaS or Hybrid SaaS tool to replace the current HCL BigFix system.

• Provide end-to-end implementation services, including setup, integration, agent deployment, and data distribution point establishment.

• Offer optional sustainment services for the ESEM tool.

• Ensure continuous visibility into security configuration compliance, time-bound vulnerability and patch remediation, and standardized exception governance.

• Support operations in segmented, intermittently connected, or constrained network zones.

• Integrate with enterprise service management, asset inventory, and security operations workflows.

• Provide capabilities for reporting exceptions and identifying non-compliant assets.

• The ESEM tool must achieve four nines (99.99%) application availability, excluding a 4-hour monthly maintenance window.

• Content (patches) must be available within 24 hours of release.

• Real-time monitoring, reporting, and enforcement of compliance policies (e.g., STIGs, CIS benchmarks).

• Data retention: minimum 6 months for all collected metrics, 3.5 years for vulnerability, software usage, and remediation data.

• Audit log retention: minimum 1 year.

• Performance Period (PoP): 12-month base year plus five (5) 12-month option periods, and two (2) optional tasks. Total PoP not to exceed 72 months.

• Place of Performance: Contractor facilities.

• Travel: Not anticipated.

• Security: Compliance with VA cybersecurity directives, Zero Trust principles, FICAM, IPv6, TIC, and NIST standards. PIV card enablement required.

• Integration: Seamless integration with existing VA tools such as ServiceNow (SNOW), ICAMP, Enterprise Logging Warehouse (Splunk), GRC (ServiceNow CAM), CrowdStrike, Microsoft Active Directory, EntraID, Azure, and AWS.

• SaaS Requirements: Must meet FedRAMP requirements (Moderate initially, High expected within 12 months). Data location within the Continental United States.

• Deliverables: Contractor Project Management Plan, Monthly Activity Reports, Kick-Off Meeting Presentation, Transition Out Plan, ESEM Tool entitlement, various SOPs, reports, and documentation.

• Personnel: Pre-screening, background investigations, and adherence to VA security and privacy requirements.

• Compliance: Adherence to VA Technical Reference Model (TRM), VIP, PLM, PAL, and specific security checklists (DISA STIGs, CIS benchmarks).

Request for Information (RFI)

This RFI is issued by the Department of Veterans Affairs (VA) for market research purposes to identify alternative endpoint management solutions to their current HCL BigFix system. This RFI does not constitute a Request for Quote (RFQ) or Proposal (RFP), and the VA is not currently seeking proposals or quotes. The information gathered will help the VA develop its acquisition strategy and Performance Work Statement (PWS).

The VA is seeking alternative products that can meet or exceed the capabilities of their current BigFix solution for managing up to 150,000 clients/endpoints across on-premises, AWS, and Azure environments. Key prioritized capabilities include:

• Cross-OS Patch: Patching for Windows Server, Linux, Solaris, and MacOS, with content available within 24 hours of release.
• Real-Time Compliance/Enforcement: Continuous monitoring and enforcement of policies, including real-time detection and remediation of CCE and CVE.
• Offline/Air-Gapped Support: Full functionality for endpoints not always connected to the network.
• Third-Party Patch Catalog Depth: Extensive library for third-party application patching.
• Role-Based Control / Least Privilege: Implementing granular access controls.
• Compliance Reporting: Detailed reports based on STIG, CIS benchmarks, and USGCB, with customization support.
• Integration: Seamless integration with CMDB, SIEM, SOAR, Azure, AWS, and ServiceNow via APIs.
• Software Distribution: Managing application and update deployment.
• Asset Discovery / Management: Comprehensive inventory of hardware and software assets.
• Vulnerability Correlation: Linking vulnerabilities with patch availability for prioritization.
• Automation at Scale: Handling over 500,000 endpoints.
• Federal Compliance: Adherence to FISMA/CDM mandates.

Vendors are requested to provide:

• A capability statement (max 10 pages) describing their company's ability to meet the requirements.

• A brief technical solution summary addressing how their product meets each of the 12 prioritized capabilities, including supported client versions and third-party support.

• A Rough Order of Magnitude (ROM) cost estimate for professional services, with a detailed breakdown of labor categories and FTEs.

• Comments on the sufficiency of the draft PWS and recommendations for improvement.

• Company identification information (Name, Address, POC, Size, NAICS, Schedules held).

• For small businesses, information on meeting set-aside requirements and available resources.

• For SDVOSB/VOSB, details on subcontracting to eligible firms.

• Response Date/Time: February 3, 2026, 1:00 PM Eastern Time, New York, USA.

• Submission Method: Email to Angel Santos (Angel.Santos2@va.gov) and Kendra Casebolt (Kendra.Casebolt@va.gov).

• Subject Line: "RFI# 36C10B26Q0142"

• This is an RFI only; no contract will be awarded based on this request.

• No costs incurred in response to this RFI will be reimbursed.

• A Draft PWS is attached for reference.