DA10--Modernized Enterprise Electronic Freedom of Information Act (eFOIA) SaaS Solution

Statement of Work (SOW) / Performance Work Statement (PWS)

This Performance Work Statement (PWS) outlines the requirements for a Commercial Off-the-Shelf (COTS) Modernized Enterprise Electronic Freedom of Information Act (eFOIA) Software as a Service (SaaS) solution. The objective is to provide a comprehensive system for managing FOIA requests, processing, reviewing, analyzing, and producing electronically stored information in compliance with legal obligations.

The contractor shall provide a COTS eFOIA SaaS solution, including project management, training, data migration, human-centered design, application performance monitoring, risk management, information assurance, operations and maintenance, and lessons learned.

• Period of Performance (PoP): 12-month base period plus four 12-month option periods.

• Place of Performance: Contractor facilities. Remote work may be approved by the Government Program Manager.

• Business Hours: Monday through Friday, 9:00 am to 5:00 pm Eastern Time.

• Holidays: The contractor will observe 11 Federal holidays.

• Solution Delivery: Fully configured, deployed, and baselined solution within 30 calendar days of award; go-live within 90 calendar days.

• Availability: Solution must be operational, reliable, and available at least 99.9% of the time each calendar month (excluding approved planned maintenance).

• Scalability: Solution must be expandable and scalable without redesign or replacement.

• Salient Characteristics:

  • Current FedRAMP Moderate authorization and FISMA Moderate compliance.
  • API integration capabilities with VA information management systems.
  • Processing of FOIA, Privacy Act, and combined requests.
  • Ingestion, viewing, processing, and export of large electronic files (up to 20 GB per file).
  • Document review capabilities with automated redaction and revision history.
  • Public-facing portal for request submission and status tracking.
  • Support for VA-approved digital identity providers.
  • Comprehensive search capabilities (keyword, Boolean, proximity, metadata).
  • Automated processing with Optical Character Recognition (OCR) and content analytics.
  • Configurable dashboard for reporting and oversight.
  • Substantial Interest review process.
  • FOIA Reading Room for public access to proactive disclosures.
  • Correspondence management with standardized templates.
  • Analysis and classification of inbound requests.
  • Immutable audit log of all user and solution actions.
  • Complete data dictionary.
  • Support for Privacy Act requests.
  • Compliance with Federal accessibility requirements (Section 508).
  • Web-based and accessible from any VA location.
  • Support for at least 900 concurrent active users.
  • Minimum of 15 terabytes of active storage for FOIA records.
  • Capability for up to 15 fully segregated operational environments.

• Project Management: Contractor Project Management Plan (CPMP), Monthly Progress Reports, Technical Kickoff Meeting.

• Information Assurance: Compliance with Risk Management Framework (RMF) and VA security requirements.

• Data Migration: Migration of existing FOIA data from FOIAXpress to the new solution (base period only).

• Maintenance: Release management, 24x7x365 help desk support, incident/issue resolution.

• Training: Initial and recurrent training for VA staff, including user guides and administrator guides.

• Lessons Learned: Annual eFOIA SaaS Project Activity Lessons Learned Report.

• Assessment & Authorization: Compliance with FedRAMP and VA authorization processes.

• Executive Analytics: Enhanced executive analytics dashboard capability.

• Optional Task One: Transition Support (90-180 days).

• Optional Task Two: Additional Storage (up to 20 TB per exercise).

• Optional Task Three: Additional Concurrent Users (up to 10 per exercise).

• Optional Task Four: API Integration Enablement and Configuration (up to four APIs).

• Compliance with VA Technical Reference Model (TRM).

• Adherence to Zero Trust security principles and VA Critical Security Controls.

• Compliance with Federal Identity, Credential, and Access Management (FICAM) standards.

• Support for Internet Protocol Version 6 (IPv6).

• Compliance with Trusted Internet Connection (TIC) requirements.

• Use of standard VA computer configuration (Windows 10/11, Edge, Office 365).

• Support for Veteran-Focused Integration Process (VIP) and Product Line Management (PLM).

• Adherence to OIT Process Asset Library (PAL).

• Compliance with Authoritative Data Sources (ADS).

• Social Security Number (SSN) reduction and use of Integrated Control Number (ICN).

• Strict adherence to security and privacy requirements, including position/task risk designation and contractor personnel security requirements.

• Compliance with all VA policies and procedures governing information security, including confidentiality and non-disclosure.

• All deliverables must be provided in electronic format.

• Performance metrics include Technical/Quality, Project Milestones/Schedule, Cost/Staffing, and Management.

• Government will provide office space and system access when work is performed at a Government location.

• Remote access to VA systems must use approved methods (CAG, AVD).

• Compliance with Section 508 accessibility standards.

• Adherence to physical security and safety requirements.

• Compliance with all VA information security and privacy language as detailed in Addenda A and B.

Request for Information (RFI) / Sources Sought

This RFI/Sources Sought is for planning purposes to gather information regarding a Modernized Enterprise Electronic Freedom of Information Act (eFOIA) SaaS Solution for the Department of Veterans Affairs (VA). It is not a solicitation for bids, quotes, or proposals, and no contract will be awarded based on this RFI. The VA is seeking capability statements to inform its acquisition strategy.

Interested parties are requested to submit a capability statement demonstrating their ability to meet the requirements outlined in the attached Draft Performance Work Statement (PWS). Specific information requested includes:

1. Technical Approach: A brief summary of your technical approach to meet the Draft PWS requirements.
2. Company Information: Name, CAGE/UEI, address, POC, contact details, socioeconomic data, business size/status, current federal contracts/vehicles, and ability to respond under specific NAICS codes (513210, 541519).
3. Implementation Timeline: For proposed solutions other than existing products, provide an implementation timeline.
4. PWS Feedback: Comments on the adequacy of the Draft PWS, suggestions for additional information, proprietary/open-source status, and FedRAMP/ATO status (including VA ATO timeline if applicable).
5. Rough Order of Magnitude (ROM): Outline of major price components.
6. Contracting Approach: Details on whether the requirement will be met solely by the prime or if teaming/subcontracting is involved.

• Deadline: Responses are due by March 10, 2026, 11:00 AM EDT.

• Format: Submit via email, limited to 10 pages. Mark as "Proprietary Information" if applicable. No marketing materials.

• Questions: Submit questions via email by March 3, 2026.

• Contract Specialist: Kawana Tyler-Simms (kawana.tyler-simms@va.gov)

• Contracting Officer: Patrick Hamilton (Patrick.Hamilton2@va.gov)

• The attached Draft PWS dated February 23, 2026, defines the scope of requirements.

• No payment will be provided for RFI responses.

• Responses will be used for internal VA planning only.