DA10--Fast IDentity Online 2 (FIDO2) - VA-26-00064800

Solicitation / RFP / RFQ

This document outlines the Department of Veterans Affairs (VA) Office of Information & Technology (OIT) requirements for a Fast Identity Online 2 (FIDO2) Solution, specifically seeking brand-name or equivalent hardware and software for token-based multi-factor authentication (MFA) and certificate management. The solution aims to support privileged credential usage and integrate with the VA's existing CyberArk platform across 180 locations. It also includes requirements for an outsourced logistics solution for token management and issuance.

• Core Solution: Brand-name Yubico or Intercede (or equivalent) for MFA tokens and certificate management.

• Hardware: USB-A and USB-C connectors required for authentication devices.

• Deployment: On-premise, cloud-based, or hybrid environments. SaaS solutions must be FedRAMP authorized.

• Integration: Must integrate with VA's enterprise CyberArk platform.

• Logistics: Outsourced solution for storing, managing, and issuing tokens.

• Deliverables: Software licenses, subscriptions, hardware tokens, maintenance, and technical support services. Initial installation services for the certificate database are required.

• Compliance: Must adhere to Section 508 accessibility standards, VA Technical Reference Model (TRM), Zero Trust security controls, IPv6 requirements, Trusted Internet Connection (TIC) 3.0, and Generative AI requirements (if applicable).

• Security: Position/task risk designation levels and contractor personnel security requirements are detailed.

• Period of Performance (PoP): One 12-month base period (August 25, 2026 – August 24, 2027) with four 12-month option periods for maintenance. Total PoP not to exceed 60 months.

• Optional Task: Additional hardware and maintenance quantities available, not to exceed specified amounts over the life of the order, with a PoP not exceeding 12 months and co-terming with the overall PoP.

• Delivery: Software licenses and subscriptions electronically upon award. Physical tokens phased by site and quantity, with a 30-day delivery after order placement. Ramp-up activities, including an online ordering website, must be completed within 45 days of award.

• Security: Contractor personnel require background investigations. Specific forms and processes for personnel vetting are outlined.

• Not explicitly stated in this document.

• The document includes detailed requirements for Generative AI, Section 508 compliance, and extensive security and privacy language (Addendum B).

• Contact information for the Contracting Officer (Mina Awad) and Contract Specialist (Erin Butler) is provided.

Request for Information (RFI)

This RFI is for planning purposes only and does not constitute a solicitation. The Department of Veterans Affairs (VA) is seeking information regarding Fast IDentity Online 2 (FIDO2) Brand Name or Equivalent solutions. The government is not obligated to acquire any products or services described and will not pay for information submitted.

• Response Date/Time: June 2, 2026, 1:00 PM Eastern Time, New York, USA.
• NAICS Code: 541519 with a size standard of 150 employees.
• Product Service Code: DA10.
• Page Limit: 10 pages. No marketing materials are allowed.
• Submission: Responses must be emailed to Erin Butler (Erin.Butler3@va.gov) and Mina Awad (Mina.Awad@va.gov) by the response date. Subject line: "Fast IDentity Online Solution". Max email file size: 5 MB.

Interested vendors must provide:

• Company Name, Address, Point of Contact, Phone, Fax, Email.

• Company Business Size and Status (including SBA VETCert proof for VOSB/SDVOSBs).

• DUNS Number.

• Existing Contractual Vehicles (GWAC, FSS, MAC).

• Summary of capability to meet requirements in the draft Product Description (PD), specifically:

  • Technical capability.
  • Experience providing and maintaining an online ordering website for physical token procurement and phased delivery.
  • Corporate experience with specific examples/references (agency, POC, dollar value, contract number).
  • Intent and ability to meet SDVOSB set-aside requirements (VAAR 852.219-73 and 13 CFR §125.6), including subcontracting plans and team member information.

• Assessment of the draft PD's sufficiency for technical requirements and production support services (YES/NO). If NO, provide technical comments/recommendations.

• A draft Product Description (PD) titled "PD Fast IDentity Online Solution BNE_26 May 2026, version 1.0" is attached.

• The VA retains discretion on post-RFI briefings and invited industry partners.