CPD DVMS RFI-TPS-26-001.pdf

REQUEST FOR INFORMATION (RFI)

DIGITAL VISITOR MANANGEMENT SYSTEM

FEDERAL BUREAU OF PRISONS

CORRECTIONAL PROGRAMS DIVISION

RFI Number: RFI-TPS-26-001 Issue Date: 09/18/2026

Response Due Date: 10/02/2026 at 11:59PM (EST)

Table of Contents

1. PURPOSE

2. BACKGROUND

2.1 AGENCY / ORGANIZATIONAL BACKGROUND

2.2 CURRENT ENVIRONMENT

2.3 OBJECTIVES

3. SCOPE OF INTEREST

3.1 DIGITAL CHECK-IN AND BADGE GENERATION

3.2 WI-FI INFRASTRUCTURE TRACKING

3.3 COLOR E-PAPER BADGE TECHNOLOGY

3.4 AUTOMATED VENDOR MANAGEMENT

4. INFORMATION REQUESTED

4.1 ORGANIZATION INFORMATION

4.2 CONTRACT VEHICLES

4.3 CORPORATE EXPERIENCE

4.4 TECHNICAL / FUNCTIONAL CAPABILITIES

4.5 SECURITY, PRIVACY, AND COMPLIANCE

4.6 CERTIFICATIONS / QUALIFICATIONS [OPTIONAL]

4.7 MANAGEMENT AND STAFFING APPROACH [OPTIONAL]

4.8 DELIVERY / IMPLEMENTATION APPROACH

4.9 CAPACITY AND AVAILABILITY [OPTIONAL]

4.10 PAST PERFORMANCE

4.11 ACQUISITION AND PRICING CONSIDERATIONS

5. GOVERNMENT QUESTIONS

6. RESPONSE INSTRUCTIONS

6.1 RESPONSE FORMAT

6.2 SUBMISSION DEADLINE

6.3 SUBMISSION METHOD

6.4 QUESTIONS

7. GENERAL INFORMATION AND DISCLAIMERS

7.1 RFI ONLY

7.2 NO GOVERNMENT OBLIGATION

7.3 NO REIMBURSEMENT

7.4 PROPRIETARY INFORMATION

7.5 USE OF INFORMATION

7.6 VENDOR DISCUSSIONS AND DEMONSTRATIONS

7.7 FUTURE ACQUISITION

8. SMALL BUSINESS AND SOCIOECONOMIC INFORMATION

9. ANTICIPATED REQUIREMENT INFORMATION

10. REQUIREMENT-SPECIFIC CONSIDERATIONS

11. DOCUMENT CONTROL

1. PURPOSE

The Federal Bureau of Prisons (FBOP), Correctional Programs Division, is issuing this Request for Information (RFI) to conduct market research and obtain information from industry regarding capabilities, solutions, products, services, approaches, and other considerations related to a comprehensive Visitor Management System (VMS) for headquarters with future expansion to federal correctional facilities.

The purpose of this RFI is to assist the Government in understanding the current marketplace, available capabilities, potential sources, acquisition approaches, industry practices, and other factors that may inform development of a future requirement.

This RFI is issued solely for market research and acquisition planning purposes. It does not constitute a Request for Proposal (RFP), Request for Quotation (RFQ), Invitation for Bid (IFB), or other solicitation. Issuance of this RFI does not obligate the Government to issue a future solicitation or award a contract.

The Government will not reimburse respondents for costs associated with preparing or submitting information in response to this RFI.

2. BACKGROUND

2.1 Agency / Organizational Background

The Federal Bureau of Prisons (FBOP) is responsible for the custody and care of approximately 150,000+ federal offenders. Approximately 133,000 of these inmates are confined in FBOP-operated correctional institutions or detention centers, while the remainder are confined in privately managed or community-based facilities.

The FBOP operates 119 facilities nationwide, including:

Federal Correctional Institutions (FCIs)

Federal Correctional Complexes (FCCs)

United States Penitentiaries (USPs)

Federal Prison Camps (FPCs)

Federal Medical Centers (FMCs)

Federal Detention Centers (FDCs)

Metropolitan Correctional Centers (MCCs)

Metropolitan Detention Centers (MDCs)

Headquarters, Regional Offices

Administrative facilities

Each facility manages multiple visitor categories daily, including:

Family and friends of inmates

Legal representatives (attorneys, paralegals)

Government officials and inspectors

Healthcare providers and contractors

Maintenance and construction vendors

Educational and religious program volunteers

Contractors

Media and approved researchers

Security and accountability are paramount in all FBOP operations. The agency requires systems that enhance security posture while improving operational efficiency and visitor experience in BOP headquarters, regional offices and within the constraints of a correctional environment.

2.2 Current Environment

The FBOP currently operates various visitor management processes across its facilities, many of which rely on manual or semi-automated systems:

Existing Processes:

Manual logbook sign-in at many facilities

Limited real-time visibility of visitor locations within facilities

Manual vendor credential verification

Separate systems for tracking different visitor types

Current Challenges:

Lengthy check-in times, particularly during peak visiting hours

Limited ability to track visitor movements in real-time

Manual data entry leading to potential errors and inefficiencies

Inconsistent processes across facilities

Limited integration with existing security systems

Difficulty in generating comprehensive visitor analytics and reports

No automated notification capabilities for visitors, volunteers, or contractors

Resource-intensive vendor credentialing and escort requirements

Existing Infrastructure:

Enterprise-wide network infrastructure with Wi-Fi coverage at all facilities

Existing security and access control systems

Video surveillance systems

Identity verification capabilities at facility entrances

Centralized data center and cloud infrastructure

Operational Scale:

119 Correctional facilities across the United States

Hundreds of thousands of visitor transactions annually

Thousands of regular visitors, volunteers, and contractors

24/7 operations with varying staffing levels

Multiple security levels for different visitors

2.3 Objectives

The Government is conducting market research to better understand potential approaches for achieving the following objectives:

Enhance Security: Improve visitor, volunteer, and contractor identification, tracking, and accountability throughout all facilities while maintaining compliance with federal security requirements.

Streamline Operations: Reduce administrative burden on staff through automation and digital processes while maintaining security protocols.

Improve Visitor Experience: Create a more efficient, transparent, and user-friendly check-in process for authorized visitors while maintaining necessary security measures.

Enable Real-Time Visibility: Provide facility staff with accurate, real-time information on visitor locations and status within the facility.

Standardize Processes: Implement consistent visitor management procedures across all FBOP facilities with flexibility for site-specific security requirements.

Leverage Existing Infrastructure: If possible, utilize existing Wi-Fi and network infrastructure for cost-effective location tracking capabilities.

Automate Vendor Management: Reduce staff workload and improve vendor access efficiency through self-service capabilities and pre-arrival processing.

Enhance Reporting and Analytics: Generate comprehensive data for security audits, operational analysis, and compliance reporting.

Support Integration: Enable integration with existing FBOP security systems, access control, and administrative platforms.

3. SCOPE OF INTEREST

The Government is interested in obtaining information regarding industry capabilities associated with the following areas.

3.1 Digital Check-In and Badge Generation

Digital Check-In Process:

Intuitive user interface for staff-assisted or self-service check-in.

Identity verification and credential scanning capabilities.

Photo capture and comparison with government-issued identification.

Integration with visitor pre-registration systems.

Watchlist and database screening (NCIC, state registries, FBOP-specific databases).

Background check integration capabilities.

Digital signature capture for visitor agreements and facility rules acknowledgment.

Visitor history and previous visit tracking.

Support for walk-in and pre-registered visitors.

Multi-language support.

Instant Badge Generation:

On-demand printing or generation of visitor badges upon approval.

Clear display of visitor name, photo, date, time, facility, and authorized areas.

Color-coding or visual indicators for visitor types (family, legal, vendor, official).

Barcode, QR code, or RFID encoding for tracking and validation.

Tamper-evident or secure badge formats.

Quick badge activation and deactivation.

Temporary badge expiration capabilities.

Badge reissuance for repeat visitors.

Automated Notifications:

Real-time alerts to designated staff upon visitor arrival/departure.

Automated alerts for watchlist matches or credentialing issues.

Staff notifications for visitor check-out or badge expiration.

Emergency recall notifications to all visitors if needed.

Vendor arrival notifications to appropriate departments.

Escalation alerts for delayed or missing check-outs.

Integration capabilities with email, SMS, or facility communication systems.

3.2 Wi-Fi Infrastructure Tracking

The FBOP is interested in solutions that leverage existing network infrastructure for visitor location monitoring, and if required, installation of additional network infrastructure:

Real-Time Location Monitoring:

Utilization of existing Wi-Fi access points for location triangulation.

If required, utilization of new Wi-Fi access points for location triangulation.

Integration with badge technology (RFID, BLE, or other wireless protocols).

Real-time tracking of visitor locations within authorized areas.

Dashboard display showing visitor locations on facility maps.

Historical location tracking and movement patterns.

Zone-based tracking with configurable facility areas.

Infrastructure Requirements:

Compatibility with existing Cisco or other enterprise wireless infrastructure.

Minimal additional hardware requirements.

Scalability across facilities of varying sizes.

Network security and segmentation considerations.

Bandwidth and performance impact assessment.

Alerting and Compliance:

Automated alerts when visitors enter restricted or unauthorized areas.

Geofencing capabilities with configurable boundaries.

Duration tracking for visitors in specific zones.

Visitor reunification capabilities during emergencies.

Escort compliance monitoring.

Audit trail of all location data.

Technical Considerations:

Location accuracy requirements and limitations.

Latency in location updates.

Impact on network performance.

Privacy and data retention considerations.

Integration with existing Physical Security Information Management (PSIM) systems.

3.3 Color E-Paper Badge Technology

The FBOP seeks information on advanced badge technology featuring:

Color E-Paper Display Capabilities:

Full-color electronic paper displays on reusable badge hardware.

High-resolution display of visitor photo, name, and credentials.

Dynamic content that can be updated remotely and in real-time.

Visibility in various lighting conditions (indoor/outdoor).

Battery life sufficient for extended visit durations.

Durability appropriate for correctional facility environments

Real-Time Update Capabilities:

Remote updating of badge information during active visits.

Status change indicators (authorized, expired, escorted required, emergency).

Time remaining displays or expiration countdowns.

Color changes based on status, visitor type, or alert conditions.

Emergency messaging capabilities displayed on badge.

QR code or barcode generation on e-paper display for scanning.

Enhanced Security Features:

Tamper detection and alerts.

Automatic deactivation upon unauthorized removal.

Encrypted communication between badge and system.

Battery level monitoring with low-battery alerts.

Return verification and accountability tracking.

Difficult to counterfeit or duplicate.

Visual indicators for expired or invalid badges.

Operational Considerations:

Badge sanitization and reuse procedures.

Badge inventory management.

Charging infrastructure requirements.

Badge lifespan and replacement cycles.

Cost-effectiveness compared to disposable badge systems.

Size, weight, and wearing comfort.

Compatibility with various attachment methods (clip, lanyard, wristband, etc.)

3.4 Automated Vendor Management

The FBOP is interested in streamlined vendor access solutions including:

Smart Badge Technology for Vendors:

Reusable smart badges issued to frequent vendors and contractors.

Bluetooth Low Energy (BLE) or similar wireless technology.

Secure storage of vendor credentials and access authorizations.

Multi-facility access capabilities where appropriate.

Tamper-evident and traceable badge assignment.

Pre-Arrival Check-In:

Mobile application or web portal for vendor pre-registration.

Submission of credentials, insurance, and required documentation in advance.

Pre-approval workflows and notifications.

Scheduled visit management and calendar integration.

Automatic credential expiration tracking and renewal reminders.

Background check status verification.

Streamlined Access Process:

BLE-enabled automatic detection upon vendor arrival.

Express lane or expedited check-in for pre-approved vendors.

Reduced staff intervention for routine vendor visits.

Automated access authorization validation.

Integration with vehicle registration systems.

Tool and equipment inventory tracking.

Vendor Portal Capabilities:

Self-service profile management.

Document upload and management.

Visit history and reporting.

Training and certification tracking.

Facility-specific requirements and instructions.

Communication with facility coordinators.

Security and Compliance:

Credential verification against government databases.

Insurance and certification validation.

Access privilege management by facility and area.

Audit trail of all vendor activities.

Revocation capabilities and blacklist management.

Compliance with federal credentialing standards (HSPD-12, PIV, etc.).

4. INFORMATION REQUESTED

Respondents are requested to provide information applicable to their proposed capabilities, products, services, or approaches.

4.1 Organization Information

Provide:

Legal business name

Business address

Unique Entity Identifier (UEI)

CAGE Code, if applicable

Business size and socioeconomic status

Primary point of contact

Telephone number

Email address

Company website

Years in business

Relevant business areas or capabilities

Note: Use UEI rather than DUNS for current federal acquisition information.

4.2 Contract Vehicles

Identify any federal contract vehicles through which the proposed products or services may be acquired, as applicable.

Examples may include:

GSA Multiple Award Schedule

Governmentwide Acquisition Contracts (GWACs)

Agency-specific IDIQ contracts

BPAs

Other applicable contract vehicles

For each applicable vehicle, identify the contract number, relevant SIN/category/pool, and period of performance.

4.3 Corporate Experience

Describe the organization's experience performing work comparable in scope, scale, complexity, and technical or operational characteristics to the contemplated requirement.

Include, as applicable:

Relevant federal experience

State, local, tribal, territorial, or commercial experience

Experience in comparable operating environments

Experience supporting organizations of similar size or complexity

Relevant products, services, technologies, or methodologies

Experience managing similar risks, constraints, or dependencies

4.4 Technical / Functional Capabilities

Describe capabilities relevant to the requirement, including, as applicable:

System Architecture:

Cloud-based, on-premises, or hybrid deployment options

System scalability for 122+ facilities

Multi-facility and enterprise management capabilities

Redundancy and high-availability architecture

Disaster recovery and business continuity capabilities

Integration and Interoperability:

API capabilities and documentation

Integration with identity verification systems

Integration with access control systems (e.g., S2, Lenel, Software House)

Integration with video surveillance systems

Integration with Physical Security Information Management (PSIM) platforms

Database connectivity (NCIC, state registries, custom watchlists)

Single sign-on and directory service integration (Active Directory, CAC/PIV)

Standards compliance (FIPS 140-2, OASIS, REST APIs, etc.)

Badge Technology:

E-paper display specifications (size, resolution, color capabilities)

Wireless communication protocols (BLE, RFID, NFC)

Battery life and charging requirements

Environmental durability (temperature, humidity, shock resistance)

Badge management and inventory tracking

Sanitization compatibility

Wi-Fi Location Tracking:

Compatible wireless infrastructure vendors

Location accuracy and update frequency

Minimum access point density requirements

Support for multiple wireless protocols

Network performance impact

User Experience:

Staff interface design and workflow

Self-service kiosk capabilities

Mobile application features

Accessibility compliance (Section 508)

Training and user documentation

Reporting and Analytics:

Real-time dashboards and visualizations

Standard and custom report generation

Data export capabilities

Historical trend analysis

Compliance and audit reporting

Performance and Scalability:

Concurrent user capacity

Transaction volume capabilities

Response time and latency specifications

Geographic distribution capabilities

4.5 Security, Privacy, and Compliance

Describe relevant experience and capabilities associated with applicable security, privacy, records management, accessibility, and regulatory requirements.

Specifically address:

Cybersecurity:

Federal Information Security Management Act (FISMA) compliance experience

FedRAMP authorization (if cloud-based) or ability to achieve authorization

FIPS 140-2 validated cryptography

Secure data transmission and storage (encryption at rest and in transit)

Role-based access control (RBAC)

Multi-factor authentication capabilities

Security logging and monitoring

Penetration testing and vulnerability assessment practices

Incident response capabilities

Supply chain risk management

Privacy:

Privacy Impact Assessment (PIA) experience

Compliance with Privacy Act of 1974

Personally Identifiable Information (PII) handling procedures

Data retention and disposal policies

Consent and notification mechanisms

Privacy by Design principles

Federal Standards and Policies:

NIST Cybersecurity Framework alignment

NIST SP 800-53 control implementation

Compliance with Federal Identity, Credential, and Access Management (FICAM)

Criminal Justice Information Services (CJIS) Security Policy compliance

Section 508 accessibility standards

HSPD-12 compatibility

Continuous monitoring

Data Management:

Data ownership and portability

Backup and recovery procedures

Records management compliance

Data segregation in multi-tenant environments

Audit logging and tamper-evidence

Authorizations and Attestations:

Current security authorizations (ATO, FedRAMP, etc.)

SOC 2 Type II or other third-party assessments

Relevant compliance certifications

Independent security testing results

Respondents should identify relevant authorizations, attestations, certifications, or compliance experience, where applicable.

4.6 Certifications / Qualifications [OPTIONAL]

Identify organizational or personnel certifications, qualifications, authorizations, licenses, or partner designations relevant to the contemplated requirement.

Examples:

FedRAMP authorization level (if applicable)

ISO 27001 Information Security Management

ISO 9001 Quality Management

CMMI certification

Project Management Professional (PMP) certified staff

Certified Information Systems Security Professional (CISSP) staff

Technology partner certifications (Cisco, Microsoft, AWS, etc.)

Criminal justice system certifications

Section 508 Trusted Tester certification

Other relevant qualifications

Unless otherwise stated, identification of certifications in this RFI does not establish a mandatory future solicitation requirement.

[CERTIFICATION / QUALIFICATION 1]

[CERTIFICATION / QUALIFICATION 2]

[CERTIFICATION / QUALIFICATION 3]

4.7 Management and Staffing Approach [OPTIONAL]

Describe the organization's typical approach to managing requirements of similar size and complexity.

Consider addressing:

Program and project management methodology

Staffing model for enterprise deployments

Key personnel roles and experience levels

Workforce availability and geographic distribution

Recruitment and retention strategies for security-cleared or background-checked personnel

Subcontractor or teaming arrangements

Quality management and quality assurance processes

Risk management approach

Configuration and change management procedures

Communication and reporting protocols

Transition-in approach and knowledge transfer

Transition-out and data extraction procedures

4.8 Delivery / Implementation Approach

Describe the respondent's typical methodology for implementing or delivering comparable capabilities.

Consider addressing:

Implementation methodology and project phases

Estimated timeline for full enterprise deployment (122 facilities)

Phased rollout versus simultaneous deployment options

Pilot program recommendations

Site preparation and infrastructure assessment

Hardware installation and configuration

Software deployment and configuration

Integration with existing systems

Data migration from legacy systems

Testing and quality assurance approach (system, integration, user acceptance)

Training programs (administrators, facility staff, end users)

Go-live support and stabilization

Ongoing operations and sustainment model

Continuous improvement processes

System upgrades and patch management

4.9 Capacity and Availability [OPTIONAL]

Describe:

Current capacity to support a requirement of this size (122 facilities)

Staffing availability for enterprise implementation

Typical mobilization or transition timeframe after contract award

Lead times for hardware procurement (badges, kiosks, infrastructure)

Manufacturing capacity for e-paper badges

Dependencies affecting availability (supply chain, personnel, technology)

Ability to scale resources during implementation and operations

Support coverage (hours, time zones, service levels)

Warranty and lifecycle support for hardware components

4.10 Past Performance

Provide up to three (3) examples of relevant work performed within the past [3–5] years, as appropriate.

For each example, provide:

Customer or organization name

Contract or project title

Contract number, if applicable

Period of performance

Approximate contract value

Description of work performed

Number of facilities or sites supported

Scope and scale (number of users, transactions, etc.)

Technologies implemented

Relevance to the contemplated FBOP requirement

Outcomes and performance metrics achieved

Point of contact information (name, title, phone, email), if available and appropriate

Preference for examples demonstrating:

Federal agency implementations, particularly law enforcement or corrections

High-security facility environments

Enterprise-scale deployments across multiple sites

Wi-Fi-based tracking implementations

E-paper or advanced badge technology deployments

Vendor management automation

Integration with existing security systems

4.11 Acquisition and Pricing Considerations

The Government may request general market information regarding acquisition or pricing approaches.

Respondents may address:

Pricing Models:

Common commercial pricing structures for visitor management systems

Software licensing approaches (perpetual, subscription, SaaS)

Per-facility, per-user, per-transaction, or enterprise pricing

Hardware costs (badges, readers, kiosks, charging stations)

Implementation and integration service pricing

Training costs

Ongoing maintenance and support costs

Cloud hosting or infrastructure costs (if applicable)

Cost Drivers:

Primary factors affecting total cost of ownership

Economies of scale for enterprise deployments

Volume pricing considerations

Optional features or modules

Customization and integration costs

Contract Structures:

Recommended contract type (FFP, T&M, hybrid)

Period of performance recommendations

Hardware refresh and technology obsolescence considerations

Options for phased implementation

Recommended warranty and support periods

Cost Efficiencies:

Opportunities to leverage existing infrastructure

Use of commercial off-the-shelf (COTS) products

Modular approach to reduce initial investment

Pilot program scope and cost

The Government is not requesting a binding price proposal as part of this RFI unless expressly stated otherwise.

5. GOVERNMENT QUESTIONS

Respondents are requested to address the following questions, as applicable.

1. Describe your organization's experience providing visitor management capabilities comparable to the contemplated requirement, particularly in correctional or high-security federal facilities.

2. What products, services, technologies, or approaches would you recommend the Government consider for this requirement? Are there emerging technologies that should be evaluated?

3. What acquisition approach or contract structure would best support this requirement, and why? Should the requirement be structured as a single award or multiple awards?

4. Are there aspects of the contemplated requirement that may unnecessarily restrict competition or limit available solutions?

5. What information should the Government provide in a future solicitation to allow industry to develop accurate technical and pricing responses (e.g., facility layouts, network diagrams, current visitor volumes)?

6. What are the primary technical, operational, schedule, security, supply chain, or implementation risks associated with this type of requirement in correctional facilities?

7. What strategies would you recommend to mitigate the risks identified above?

8. What transition or implementation timeframe would be reasonable for: (a) a pilot facility,

(b) a regional rollout (20-30 facilities), and (c) full enterprise deployment (122 facilities)?

9. What Government-furnished information, equipment, systems, access, facilities, or other resources would typically be necessary to support successful implementation?

10. Are there commercial off-the-shelf products or established industry practices that could satisfy all or part of the requirement with minimal customization?

11. How mature is color e-paper badge technology for correctional facility applications?

What are the current limitations, lead times, and cost considerations?

12. What are the accuracy limitations of Wi-Fi-based location tracking, and what additional infrastructure (if any) would improve location precision within the FBOP's existing network environment?

13. How can the requirement be structured to increase competition or small business participation? Are there logical separations between hardware, software, implementation, and operations that would support multiple contractors?

14. What performance measures, service levels, or outcomes should the Government consider including in a future contract (e.g., system availability, badge processing time, location accuracy)?

15. What level of vendor pre-credentialing and background checks is supported by your solution, and how does this integrate with federal security standards (HSPD-12, PIV, CJIS)?

16. Describe your approach to integration with existing FBOP systems and standard correctional facility access control platforms. What integration methods do you support?

17. What are the data retention, backup, and disaster recovery capabilities of your solution?

How is data segregated and protected in multi-facility deployments?

18. What training is required for facility staff, and what is the typical learning curve for administrators and daily users?

19. How does your solution handle emergency situations, including lockdowns, evacuations, and visitor accountability during incidents?

20. What ongoing support, maintenance, and system administration resources are required?

Can this be performed remotely, or is on-site presence required?

21. Identify any other recommendations, concerns, assumptions, dependencies, or information the Government should consider during acquisition planning for this requirement.

6. RESPONSE INSTRUCTIONS

6.1 Response Format

Responses should:

Not exceed 25 pages, excluding cover page, table of contents, past performance references, and marketing materials

Be submitted in Microsoft Word (.docx) or PDF format

Use 12-point Times New Roman or Arial font

Use margins of at least 1 inch

Clearly identify the respondent's organization on the cover page

Reference RFI Number RFI-TPS-26-001 and Visitor Management System

Follow the section numbering contained in this RFI where practical

Include page numbers

Marketing materials may be included as attachments when directly relevant but should not substitute for responses to the information requested.

6.2 Submission Deadline

Responses must be received no later than:

10/02/2026 at 11:59PM (EST)

6.3 Submission Method

Submit responses electronically to:

Stephen Pupillo Contracting Officer Email: Spupillo@bop.gov

Adam Simmonds Contracting Officer Email: aSimmonds@bop.gov

Email Subject: RFI-TPS-26-001 – DIGITAL VISITOR MANANGEMENT SYSTEM

6.4 Questions

Questions regarding this RFI should be submitted to Spupillo@bop.gov no later than:

10/02/2026 at 11:59PM (EST)

The Government may, at its discretion, post or distribute responses to questions when doing so would benefit the market research process.

7. GENERAL INFORMATION AND DISCLAIMERS

7.1 RFI Only

This notice is issued solely for information and planning purposes and does not constitute a solicitation.

The Government is not requesting proposals or quotations at this time.

7.2 No Government Obligation

Submission of information in response to this RFI does not create any obligation on the part of the Government.

The Government is not obligated to:

Issue a solicitation

Award a contract

Conduct discussions

Respond individually to respondents

Use information submitted

Select a particular acquisition strategy

7.3 No Reimbursement

The Government will not reimburse any costs incurred in preparing or submitting a response, participating in discussions, providing demonstrations, or otherwise responding to this RFI. All costs associated with responding to this RFI are solely the responsibility of the respondent.

7.4 Proprietary Information

Respondents should clearly mark proprietary or confidential business information with appropriate legends (e.g., "Proprietary," "Business Confidential," "Competition Sensitive").

Respondents should not submit classified information, controlled unclassified information (CUI), personally identifiable information (PII), or other sensitive Government information unless specifically authorized and instructed by the Government.

The Government will handle properly marked information consistent with applicable laws, regulations, and policies, including the Freedom of Information Act (FOIA). However, the Government cannot guarantee that proprietary information will not be released if required by law.

To the maximum extent possible, respondents should avoid including proprietary information or clearly segregate proprietary sections.

7.5 Use of Information

Information received may be used to support market research, requirements development, acquisition planning, cost estimation, solicitation development, and related Government activities.

Information submitted may be reviewed by Government personnel and, when authorized and subject to appropriate safeguards, support contractors assisting the Government with acquisition planning or technical evaluation.

7.6 Vendor Discussions and Demonstrations

The Government may request:

Clarifying information or follow-up questions

One-on-one industry discussions or briefings

Capability presentations or demonstrations

Product demonstrations at Government facilities or vendor locations

Technical demonstrations of specific features (e.g., e-paper badges, location tracking)

Additional market research information

Site visits to observe existing implementations

Participation in any such activity is voluntary and does not guarantee inclusion in a future solicitation, evaluation, or contract award. The Government reserves the right to limit the number of demonstrations or discussions based on relevance and available resources.

Security requirements, including background checks and facility access procedures, may apply for any visits to FBOP facilities.

7.7 Future Acquisition

Based on the results of market research, the Government may:

Develop or revise the requirement and technical specifications

Issue a Sources Sought Notice

Issue a draft solicitation for industry comment

Issue a formal solicitation (RFP, RFQ, or IFB)

Use an existing contract vehicle (GSA Schedule, GWAC, agency IDIQ)

Conduct additional market research activities

Modify the acquisition strategy or approach

Determine that no acquisition is necessary at this time

Pursue a pilot program before enterprise deployment

Take other actions determined appropriate

The Government anticipates, but does not commit to, issuing a solicitation in fiscal year 2027, subject to funding availability, mission priorities, and acquisition planning outcomes.

8. SMALL BUSINESS AND SOCIOECONOMIC INFORMATION

Respondents should identify their business size and applicable socioeconomic status under the anticipated or recommended NAICS code.

Applicable categories may include:

Small Business

8(a) Business Development Program Participant

HUBZone Small Business

Service-Disabled Veteran-Owned Small Business (SDVOSB)

Veteran-Owned Small Business (VOSB), where applicable

Women-Owned Small Business (WOSB)

Economically Disadvantaged Women-Owned Small Business (EDWOSB)

Other applicable socioeconomic categories

Respondents should clearly indicate whether they could perform the contemplated requirement as a prime contractor or would anticipate serving as a subcontractor or teaming partner.

If subcontracting or teaming is anticipated, describe:

The roles and responsibilities of the prime and subcontractors

The percentage of work anticipated for small business subcontractors

Specific areas where small businesses could contribute

Any existing teaming arrangements

The FBOP encourages participation by small businesses and socioeconomic firms. Information provided will assist the Government in determining appropriate acquisition strategies and small business considerations.

9. ANTICIPATED REQUIREMENT INFORMATION

The information below reflects the Government's current planning assumptions and is subject to change based on market research and acquisition planning.

Characteristic Current Planning Assumption

Requirement Title Visitor Management System (VMS)

NAICS Code 541512 (Computer Systems Design Services) – Subject to Market Research

Product Service Code (PSC)

D302 (IT and Telecom - Systems Development) – Subject to Revision

Business Size Standard

$34 million (for NAICS 541512)

Set-Aside TBD – Based on market research findings

Contract Vehicle TBD – May include GSA Schedule, full and open competition, or existing agency vehicle

Contract Type TBD – Potentially hybrid (FFP for hardware/licenses, T&M or FFP for implementation/support)

Contract Structure Single award or multiple awards TBD; may include base period with options

Anticipated Period of Performance

Base Period: 12-18 months (implementation)<br>Option Periods: Up to 5 years (O&M, support, licenses)

Estimated Value TBD – Subject to market research and budget availability

Place of Performance

119 FBOP facilities nationwide; remote work for some tasks may be acceptable

Remote / On-Site / Hybrid

Hybrid – On-site work required for installation and training; remote support acceptable

Security Requirements

Background investigations required for facility access; CJIS compliance for certain data access

Clearance Requirements

Security clearance not anticipated; background checks and facility access credentials required

Other Considerations Phased implementation likely<br>- Pilot program may be conducted<br>- FedRAMP authorization preferred for cloud solutions<br>- Buy American Act compliance required

Information contained in this section is preliminary and should not be interpreted as a commitment regarding the structure or content of a future acquisition.

10. REQUIREMENT-SPECIFIC CONSIDERATIONS

The following considerations are specific to the Visitor Management System requirement:

Correctional Environment Operations

Security-First Design: Solutions must prioritize security and accountability in a correctional environment where safety and custody are paramount.

Duress and Emergency Capabilities: System must support lockdown procedures, emergency evacuations, rapid visitor accountability, and duress notification.

24/7 Operations: System must support continuous operations with high reliability and availability.

Offline Capabilities: Consider scenarios where network connectivity may be temporarily interrupted; critical functions should degrade gracefully.

Federal Compliance and Standards

Criminal Justice Information Services (CJIS) Security Policy: Solutions accessing criminal justice information must comply with FBI CJIS Security Policy requirements.

FedRAMP Compliance: Cloud-based solutions must have or be capable of achieving FedRAMP authorization at the appropriate impact level (likely Moderate).

NIST Standards: Systems must comply with applicable NIST standards, including NIST SP 800-53 security controls.

Privacy Compliance: System must support Privacy Impact Assessments and comply with the Privacy Act of 1974 and FBOP privacy policies.

Accessibility: All user interfaces must comply with Section 508 accessibility standards.

Authority to Operate (ATO): Solution must support FBOP's ATO process, including security control documentation and assessment.

Technical Environment

Network Infrastructure: FBOP facilities operate on a secure government network with robust firewalls and security controls. Solutions must operate within this constrained environment.

Existing Systems: Integration considerations include:

Access control systems (various vendors across facilities)

Video surveillance systems

Federal identity management systems

National Crime Information Center (NCIC) and state law enforcement databases

Wi-Fi Infrastructure: Existing enterprise Wi-Fi is primarily Cisco-based; location tracking solutions should be compatible.

Data Center: FBOP operates both on-premises data centers and cloud environments (subject to FedRAMP requirements).

Hardware and Environmental Considerations

Durability: Badge hardware and kiosks must withstand institutional environments, including potential impacts, environmental conditions, and frequent handling.

Sanitization: All reusable hardware (badges, readers) must be compatible with institutional cleaning and sanitization protocols.

Tamper Resistance: Badge technology must resist tampering, alteration, or unauthorized replication.

Longevity: E-paper badges should have multi-year operational lifespans to support return on investment.

Visitor Types and Workflows

Solutions must accommodate diverse visitor types with different requirements:

Social Visitors (Family/Friends): Highest volume; require efficient processing, inmate notification

Legal Visitors (Attorneys): Privileged access requirements, confidentiality considerations, expedited processing

Official Visitors: Government officials, inspectors, oversight bodies requiring appropriate access levels

Vendors/Contractors: Regular access, tool/equipment tracking, pre-credentialing, multiple facility access

Volunteers: Program-based access, background checks, recurring visits

Media: Escorted access, special approval workflows

Data Management and Retention

Records Retention: Visitor records may be subject to federal records retention schedules and may be discoverable in legal proceedings.

Data Ownership: All data remains Government property; data portability and extraction must be supported.

Audit Requirements: Comprehensive audit logging for security reviews, investigations, and compliance audits.

Implementation Considerations

Minimal Operational Disruption: Implementation approach must minimize impact on facility operations and visiting hours.

Phased Rollout: Enterprise deployment will likely be phased by region, facility type, or security level.

Training: Staff across 119 facilities require training; scalable, potentially remote training approaches are valuable.

Change Management: Standardizing processes across facilities with varying local procedures requires careful change management.

Geographic and Logistical Factors

Nationwide Distribution: Facilities span all 50 states, including remote locations.

Support Requirements: On-site support may be challenging for remote facilities;

remote troubleshooting and maintenance capabilities are important.

Hardware Logistics: Badge distribution, charging station installation, and hardware refresh across 119 sites require planning.

11. DOCUMENT CONTROL

Field Information

RFI Number RFI-TPS-26-001

Requirement Title Visitor Management System

Issuing Organization

Federal Bureau of Prisons, Correctional Programs Division

Issue Date September 18, 2026

Questions Due September 28, 2026 at 5:00 PM (EST)

Response Deadline September 30, 2026 at 5:00 PM EDT (TBD)

NAICS Code (TBD)

Field Information

PSC (TBD)

Set-Aside TBD

Contracting Officer

TBD

Contract Specialist TBD

Technical POC TBD

Version 1.0

**Notice to Vendors**

This is a Request for Information (RFI) only. This notice is issued solely for information and planning purposes; it does not constitute a Request for Proposal (RFP), Request for Quotation (RFQ), or Invitation for Bid (IFB), nor does it guarantee that a formal solicitation will be issued in the future.

This RFI does not commit the Government to contract for any supply or service whatsoever. Further, the Government is not at this time seeking proposals or quotes and will not accept unsolicited proposals. Respondents are advised that the United States Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense.

Not responding to this RFI does not preclude participation in any future RFP, if issued. If a solicitation is released, it will be synopsized on the official government-wide point of entry.

It is the responsibility of the potential offerors to monitor this site for additional information pertaining to this requirement.

END OF REQUEST FOR INFORMATION