RFI QnA_IATDR_6.12.26_Final.xlsx
XLSX spreadsheet 23 KB Posted
- Solicitation number
- 36C10B26Q0501
About this file
This is a Questions and Answers document for the Infrastructure Automation Technical Debt Reduction (IATDR) Request for Information (RFI 36C10B26Q0501) issued by the Department of Veterans Affairs Technology Acquisition Center. The RFI responses were initially due June 12, 2026, but the deadline was extended to June 18, 2026 at 3:00 PM ET. Responses should be submitted via email to Angela Key (angela.key@va.gov) and John Vardouniotis (ioannis.vardouniotis@va.gov) with a maximum file size of 5 MB, and may be marked as proprietary information.
The Q&A document addresses nine vendor inquiries regarding the RFI scope and requirements. Key responses clarify that this is a new market research initiative with no prior phases or incumbent contractors. The VA is seeking to implement an enterprise automation control plane to orchestrate and govern automation tooling across its hybrid environment of on-premises data centers, private cloud, and VA Enterprise Cloud, scaled to approximately 128,000 managed endpoints (a planning estimate for licensing purposes rather than an inventory to be managed). The control plane must integrate with existing VA platforms including Microsoft Entra ID for identity management, HashiCorp Vault Enterprise and CyberArk for secrets management, GitHub Enterprise for source control, ServiceNow for change management, Splunk for log aggregation, and Dynatrace for application performance monitoring. The security level requirement is T4, and any proposed platform must achieve VA Technical Reference Model approval, meet VA Critical Security Controls, and obtain a VA ATO before production use. The VA declined to provide internal program points of contact, stating it would contact vendors with questions following submission review. Vendors requested deadline extensions of 3 to 4 business days; all extension requests received the same response directing respondents to the June 18, 2026 deadline.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 36C10B26Q0501_1.docx | DOCX document | |
| 36C10B26Q0501 0003.docx | DOCX document | |
| 36C10B26Q0501 0002.docx | DOCX document | |
| 36C10B26Q0501 0001.docx | DOCX document | |
| 36C10B26Q0501.docx | DOCX document | |
| IATDR_PWS_v1.0_6-3-2026.pdf | ||
| IATDR_RFI_Cover_Sheet_2026-06-03.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions
| Number | Question | VA RESPONSE |
| 1 | Is it possible to request a 3 day extension on this RFI. We are actively wrking it now, but would appreciate a 3 day extension to submit a comprehensive RFI response. Thank you for your consideration. | The deadline for submission has been extended to 6/18 at 3:00PM ET. |
| 2 | Would the government be willing to grant a 1 week extension to this response date? | The deadline for submission has been extended to 6/18 at 3:00PM ET. |
| 3 | Can this solicitation please be extended to 6/22? We need additional time o gather pricing and build a proper response. | The deadline for submission has been extended to 6/18 at 3:00PM ET. |
| 4 | Would you be able to tell me who in the VA is leading this effort on the Program side? | Internal VA progam point of contact information will not be provided. The VA is conducting market research through this RFI. If a vendor response is submitted, the submission will be evaluated along with all submissions. If after review by the VA there are questions, VA will reach out to the vendor with those questions. |
| 5 | 1. In Section 3.0, Scope of Work, the VA has identified 128,000 managed endpoint devices. Can the VA provide a brief overview of those endpoint devices to include: o Type of hardware (Server, Storage, Switch, desktop, printers) o Hardware Manufacturer o Operating System associated with hardware o Site location Section 5.2.2 Enterprise Integration, items 1 -5. 2. For each line item, can the VA define their current platform that the solution needs to integrate with? o Ex: Line item 1 states the Platform shall integrate with VA?s enterprise identity provider for authentication. What is that current platform? | 1. The 128,000 managed endpoints The 128,000 managed endpoints figure in Section 3.0 is a planning estimate used to size commercial platform licensing and the associated professional services for the enterprise automation control plane. It sets the scale for licensing and is not a managed-asset inventory that the platform enumerates or administers on a per-device basis. As described in the Background and Scope, the control plane orchestrates, standardizes, and governs the use of existing automation tooling across VA's hybrid environment of on-premises data centers, private cloud, and the VA Enterprise Cloud. It does not replace the underlying virtualization, container, cloud, or configuration management engines, and it is not a desktop or print-device management capability. A breakdown by hardware type, manufacturer, operating system, and site is not required to scope or price an RFI response, and a consolidated inventory at that level of detail is not available for release in support of this planning effort. Respondents should size their proposed licensing against the enterprise planning estimate and state any assumptions the model relies on, such as differentiated treatment of node types, within their response. 2. Current platforms for the Section 5.2.2 integrations The platforms that correspond to each integration in Section 5.2.2 are listed in the Government Furnished Information section at Section 6.6.2. Identity Management integrates with Microsoft Entra ID. For Secrets Management, the platform integrates with HashiCorp Vault Enterprise for secrets, CyberArk for privileged access management, Venafi for certificate management, and Thales CipherTrust for key management. Source Control integrates with GitHub Enterprise. Change Management integrates with ServiceNow. Monitoring and Logging exports to Splunk for log aggregation and Dynatrace for application performance monitoring. The Government will provide access to these capabilities as Government Furnished Information. |
| 6 | 1. Which vendor(s) performed Phases 1 and 2? 2. Will vendors that supported Phases 1 and 2 be eligible to compete for Phase 3? 3. What artifacts/deliverables will be provided to the Phase 3 contractor? 4.Has a commercial automation platform already been selected, and if so, what platform and licensing structure currently exist? 5. If the answer to Q4 is No, will the Government evaluate innovative commercial platforms that provide required functionality but have not yet achieved FedRAMP authorization, if the proposed solution includes a viable path to obtaining the required security approvals? | 1. No. There are no Phases 1 or 2; this is a new requirement with no incumbent or prior phased work. 2. Not applicable, as no prior-phase work exists. 3. None. Government-furnished information for this effort is listed in the draft PWS at Section 6.6.2. 4. No. The automation platform and its licensing are contractor-proposed and contractor-furnished, as described in the draft PWS at Sections 5.2 and 6.1.11. 5. Not as framed. The platform is deployed on premises and authorized through VA's ATO process, not FedRAMP, so FedRAMP authorization is not the gate for this effort; any proposed platform must achieve VA Technical Reference Model approval, meet the VA Critical Security Controls, and obtain a VA ATO before production use. |
| 7 | Would you be able to provide VA POCs heading this work in OIT? | Internal VA progam point of contact information will not be provided. The VA is conducting market research through this RFI. If a vendor response is submitted, the submission will be evaluated along with all submissions. If after review by the VA there are questions, VA will reach out to the vendor with those questions. |
| 8 | 1. What are the security level requirements for the resources 2. Which category/type of devices are included in the 128k devices and the quantity of each? a. The devices which are servers - how many sockets per server? 3. If an on-prem solution, would remote access to ensure 24/7 uptime be permitted? | 1. T4, per PWS. 2. Could be any automation endpoint, api endpoint or application endpoint including server, storage, network device, service, virtual machine, container. Types of devices and quantity of devices in each category is not the intentional design of this contract. If your product requires these specifics, please provide information in your response and pricing for each category. a. VA averaged- the VA has an average of 2.3 sockets per server across both baremetal physical and hypervisor environments. 3. Contractors would be able to utilize VPN or other remote access solutions, after validation, and would provide 24/7 access as requested. |
| 9 | In preparing a response to the IATDR RFI (36C10B26Q0501) and greatly appreciate the opportunity to provide input on this important initiative. To ensure we can deliver a thorough and high-quality response that fully addresses the PWS requirements including details on our proposed control plane approach, integration with existing tools such as Ansible, technical debt reduction strategies, and sizing considerations for the ~128k endpoints, we respectfully request a 4 business day extension (due 22 June) to the current response deadline. Venor would have requested 19 June but that is a Federal Holiday. This additional time would allow us to incorporate deeper insights from our technical teams and provide more comprehensive capabilities information that we believe will be valuable for VA’s market research. | The deadline for submission has been extended to 6/18 at 3:00PM ET. |
File details come from the government source that posted it. Updated .