832674192_RFI_Conveyance_Vertical_Transport_Sytem_DHA.docx

Request for Information (RFI) Subject: Request for Information (RFI) – Conveyance/Vertical Transport System (C/VTCS) in Defense Health Agency (DHA) Facilities Defense Information System Agency/Joint Interoperability Test Command is seeking information from industry to assist with the development and planning of a potential new requirement.

Background The Defense Health Agency (DHA) manages Facility-Related Control Systems (FRCS) that support safe, secure, and resilient operations in healthcare environments. One category of these systems is C/VTCS. C/VTCS deployed in Medical Treatment Facilities (MTFs) must align with Department of Defense (DoD) Information Technology (IT) cybersecurity, interoperability, and sustainment requirements. The DHA seeks to develop an enterprise standard for evaluating and integrating these systems.

Purpose This Request for Information (RFI) is issued solely for market research and planning purposes, in accordance with Federal Acquisition Regulation (FAR) Part 10. This RFI does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or Request for Quote (RFQ), and does not commit the Government to issue a solicitation or award a contract. The Government will not reimburse respondents for any costs incurred in response to this notice.

Scope The DHA Facilities Enterprise (FE) Program Management Office (PMO) is soliciting vendor input on the design, capabilities, security posture, and lifecycle support of FRCS used in DHA facilities. The Government seeks to better understand current technologies, compliance with Risk Management Framework (RMF), integration readiness, and support strategies to inform future acquisition and cybersecurity authorization efforts.

Objective DHA is developing a standard C/VTCS profile that supports consistent, secure, and sustainable deployment across the enterprise. Responses should highlight technical characteristics, cybersecurity controls, interoperability, and system readiness to support the DHA mission.

Requested Information

1. What standards or references (e.g. NIST SP 800-53, 800-82) guide your C/VTCS design and security approach?

a. Provide an overview of your C/VTCS solution, its core functions, and common configurations in a large-scale or healthcare environments.

b. Identify supported deployment modes (e.g. standalone, enterprise network connected, or client/server, web-based) and associated hardware/software dependencies.

c. Describe typical system architecture and implementation considerations for secure medical treatment facilities.

d. Does your solution integrate with or form part of an Enterprise Security System (ESS)? If so, please describe the integrated components (e.g. ACS, VSS) and whether they are provided by a single OEM or multiple vendors and please explain the interface functional requirement (monitor and/or control) and methods.

2. Does your system currently support RMF authorization? If yes, include DHA eMASS ID if applicable. If not, what gaps exist?

a. What communication interfaces are supported (e.g. Ethernet, RS-485, 802.11 wireless)?

b. Can the system operate on DHA Medical-Community of Interest (Med-COI) or other DoD networks?

c. Identify system interdependencies with other FRCS or IT systems (e.g. facility access, building automation).

3. What authentication and authorization capabilities are integrated into your system?

a. What type of system-level authentication system is used (e.g. digital certificates, mutual TLS, secure tokens)?

b. What user authentication methods are supported (e.g. passwords, biometrics, PIV/CAC, multi-factor authentication)?

c. How does the system support zero-trust principles (e.g. continuous verification, least privilege enforcement, breach containment measures)?

d. What auditing and access logging capabilities are available to trach user authentication events and system access?

4. What types of data does your C/VTCS process, store, or transmit? Does it include Personably Identifiable Information (PII) and/or electronic Protected Health Information (ePHI)? How is it secured?

a. What types of data does your system generate or process (e.g. video feeds, logs, access transactions)?

b. Does the system handle PII or ePHI?

c. What encryption standards are used for data at rest and in transit?

- Please indicate whether your system meets any applicable Federal Information Processing Standards (FIPS) requirements, including but not limited to:

FIPS 140-3: Security Requirements for Cryptographic Modules FIPS 197: Advanced Encryption Standard (AES) FIPS 199: Standards for Security Categorization of Federal Information and Information Systems FIPS 200: Minimum Security Requirements for Federal Information and Information Systems

- If your system includes cryptographic components or modules, specify whether they are FIPS 140-3 validated and provide certification references if available.

5. Describe your approach to patching, vulnerability management, and supporting credentialed scans.

a. Describe your process for delivering, testing, and validating patches and updates.

b. Can urgent OS or application patches be applied without vendor intervention?

c. What is your recommended update cadence?

d. Can the system support credentialed vulnerability scans (live and/or lab environments)?

6. Can the system be accessed remotely for maintenance? What access controls are in place?

a. Describe local remote access capabilities and supported tools (e.g. SSH, RD)

b. Does your system support external remote access via DHA’s approved B2B VPN connection (client-to-site or site-to-site)?

-If yes, confirm whether a DHA B2B VPN is already in place, or describe how your solution supports establishing one. External remote access methods outside of the DHA B2B VPN are not permitted.

c. Can the system support government-furnished endpoint protection tools (e.g. Trellix, Tanium)?

d. Are credentials provided to DHA cybersecurity teams for authorized scanning and configuration?

7. How does your system address Operational Technology (OT) security requirements?

a. Describe how the system supports OT network segmentation or isolation from IT networks.

b. Identify any secure OT protocols in use (e.g. BACnet/SC, MODBUS TCP with TLS, OPC UA with encryption).

c. Explain your approach to OT-specific patch management and vulnerability assessment at the device level, referencing Levels 1-3 of the Purdue Model (a framework that segments industrial systems by function).

-Level 1: Field Control Devices (e.g. sensors, actuators) -Level 2: Field Control Devices (e.g. PLCs, RTUs, HMIs) -Level 3: Front-End systems (e.g. servers, databases, engineering workstations)

d. What tools or processes are used to monitor OT system integrity and detect intrusions or anomalies?

e. Describe your system’s support for OT incident response, including alerting and recovery capabilities.

8. Describe your supply chain risk management and traceability of your system.

a. Does your solution comply with Defense Federal Acquisition Regulation Supplement (DFARS) 225.1101, Acquisition of Supplies?

- Specifically address compliance with the following clauses:

DFARS 252.225-7000, Buy American – Balance of Payments Program Certificate DFARS 252.225-7001, Buy American and Balance of Payments Program DFARS 252.225-7002, Qualifying Country Sources as Subcontractors

- Please provide the Line Item Number(s) and country of Origin for applicable components.

b. Does your solution include any devices or components from third- party vendors?

- If yes, identify the third-party vendor(s), describe the component(s) and their purpose within your system, and indicate whether they have met DoD RMF or other cybersecurity compliance requirements.

Response Guidelines:

Interested parties are requested to respond to this RFI with a white paper. Submissions cannot exceed 16 pages, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Responses must specifically describe the contractor’s capability to meet the requirements outlined in this RFI. Oral communications are not permissible. SAM.gov will be the sole repository for all information related to this RFI.

Companies who wish to respond to this RFI should send responses via email no later than 5:00 PM Eastern Time (ET) on March 31, 2026, to Jennifer Everly, CIV DISA EII JITC at jennifer.m.everly2.civ@mail.mil and son.m.pham2.civ@mail.mil.

Industry Discussions DISA representatives may choose to hold one-on-one discussions with vendors following RFI submissions. These discussions are intended to clarify capabilities, address solution suitability, and assess any risk areas prior to a formal solicitation. Participation in these discussions is not guaranteed and will be based on initial submission content.

Questions Verbal questions will NOT be accepted. Questions regarding this announcement must be submitted in writing via email to Gary Morrow, II CIV DISA JT at gary.g.morrow.civ@mail.mil, Jennifer Everly, CIV DISA EII JITC at jennifer.m.everly2.civ@mail.mil and Trevor Whitaker CIV DISA PSD at trevor.k.whitaker.civ@mail.mil. Answers to questions will be posted to SAM.gov. The Government does not guarantee that questions received after 5 PM ET on September 15, 2025, will be answered. The Government will not reimburse companies for any costs associated with the submissions of their responses.

Disclaimer This RFI is not a RFP and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals, nor will any award be made as a result of this synopsis.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.