RFI.docx

AGENCY: Defense Commissary Agency (DeCA) QUESTIONS DUE DATE: 03 November 2026 RESPONSE DUE DATE: 09 November 2026

1.0 PURPOSE & INTRODUCTION

This is a Request for Information (RFI) for market research purposes only, issued on behalf of the Defense Commissary Agency (DeCA). This is not a solicitation for proposals, a promise to issue a solicitation in the future, or a commitment to purchase any products or services. The information provided in this RFI is subject to change and is not binding on the Government. The Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested party’s expense.

The purpose of this RFI is to gauge market capability, identify qualified industry sources, and gather feedback on providing an end-to-end operational solution for DeCA’s worldwide enterprise mobile computing fleet. The scope encompasses:

1. Secure Software Subscriptions & Dedicated Infrastructure: Provisioning of software licenses, comprehensive hardware maintenance, and full technical integration services necessary to support DeCA’s Zebra handheld terminals and SOTI MobiControl Mobile Device Management (MDM) environment.

1. Technical Integration & Staging Services: Professional configuration, barcode symbology enablement, device staging, and integration with DeCA's core enterprise retail, inventory, and warehouse systems.

1. Ongoing Hardware Maintenance & Support Services: Comprehensive depot repair, rapid-exchange warranty administration, logistics management, and global enterprise technical help desk support.

1. DoD Cybersecurity Compliance: Vulnerability remediation, security technical implementation guide (STIG) enforcement, and Risk Management Framework (RMF) support to maintain the system's Authorization to Operate (ATO).

1. Life-of-Contract Technology Refresh (Optional CLINs): Pre-priced option structures allowing DeCA to procure replacement handheld terminals, next-generation form factors, and updated charging accessories as fielded devices reach End-of-Life (EOL), End-of-Sale (EOS), or operational obsolescence.

2.0 BACKGROUND

The Defense Commissary Agency (DeCA or the Agency) is a component of the Department of War (DoW) reporting to the Under Secretary of War for Personnel and Readiness. DeCA is headquartered at Fort Lee, Virginia, and operates a worldwide system of 235 commissaries in 45 states, 13 countries and two U.S. territories (approximately 3,000 lanes including self-checkouts). DeCA is a global agency, with annual sales over $4.6 billion and employing more than 14,000 people. DeCA Commissaries sell food and related household items to Active, Reserve, and National Guard members of the Uniformed Services, retirees of these Services, service-related disabled veterans, authorized family members, and other authorized patrons (customers).

Commissaries operate similarly to commercial supermarkets, utilizing mobile computing hardware and automated back-office systems for inventory accounting, goods receiving, price verification, shelf-label printing, and warehouse management. DeCA is currently fielding modern, ruggedized Zebra Android Handheld Terminals (HHTs) across its worldwide enterprise to replace legacy terminals that have reached their operational lifecycle limits.

To manage, secure, and update this mobile computing fleet across geographically dispersed and remote military installations, DeCA leverages the SOTI MobiControl Mobile Device Management (MDM) platform. The Agency requires an integrated vendor capability to deliver the requisite software licensing, backend hosting, technical integration services, hardware repair logistics, and a viable mechanism for periodic technology refreshes over the life of the contract.

3.0 SCOPE OF REQUIREMENTS

3.1 Software Subscriptions & Dedicated MDM Server Infrastructure

· MDM Client Subscriptions: Annual, per-device subscription licensing supporting a baseline fleet of approximately 2,709 active Zebra handheld terminals. Subscriptions must include major version upgrades, feature releases, maintenance point releases, and security patches. Licensing models must support dynamic adjustments (adding or de-registering units) to reflect phased rollouts and legacy device retirements.

· Dedicated Server Environments: Deployment and administration of separate, dedicated hosting environments for SOTI MobiControl services (including production and dedicated test and evaluation instances). Core software stacks must include current enterprise operating systems (e.g., Windows Server Core with active Software Assurance), database licensing (e.g., SQL Server Standard Core and Developer editions), enterprise systems monitoring, and disaster recovery replication platforms.

· The SOTI MobiControl platform will operate within Government-designated virtual server environments and will be responsible for enterprise-wide hardware configuration management, patch deployment, operating system updates, and application distribution across the full solution set.

3.2 Technical Integration, Staging, and Deployment Services

· Application Configuration & Baseline Staging: Factory/depot staging, secure profile creation, OS image baseline locking, and integration with DeCA's enterprise applications (e.g., Enterprise Inventory Management, Warehouse Management Systems, Food Processing/Production Systems, and Shelf Price Verification engines).

· Third-Party Application Hosting & Deployment: Manage vendor‑provided applications by coordinating directly with application vendors to configure, package, validate, and deploy them across the enterprise mobile device fleet.

· Barcode Symbology & Peripheral Interoperability: Configuration of commercial scanning engines to support all standard commercial 1D, 2D, and postal symbologies (UPC, EAN, GS1 DataBar, QR codes, DataMatrix, GTIN) without eliminating out-of-the-box decoding performance. Seamless wireless integration with mobile Wi-Fi/Bluetooth label printers, multi-slot intelligent storage cabinets, and vehicle-mount cradles.

· Endpoint & Peripheral Versatility: Assess and support SOTI MobiControl management capabilities across a diverse range of endpoints, including Zebra mobile printers, iOS and Android devices, and field‑deployed tablets, ensuring consistent configuration, monitoring, and deployment across the enterprise.

· Global Rollout Logistics: Turnkey distribution management to all CONUS and OCONUS store and warehouse locations, including secure packaging, transit tracking, customs clearance preparation for overseas destinations, and remote connectivity verification during store cutover

3.3 Hardware Maintenance, Spares Depot, and Enterprise Technical Support

· Hardware Maintenance & Warranty Management: Comprehensive lifecycle hardware support coordinating OEM warranty coverage (e.g., Zebra OneCare Essential) with advanced spare depot provisioning. Defective units must be replaced via a rapid-exchange model (pre-configured replacement shipped to the site prior to returning the defective unit) to ensure zero store operational downtime.

· High-Level Service Desk Operations: Continuous (24/7/365) global technical support and incident management integrated with DeCA's enterprise ticketing systems. Maintenance support must adhere to standard commercial service level agreements (SLAs) for rapid response and resolution of mission-critical and routine inquiries.

· Disposal and Decommissioning: Environmentally compliant and DoD-certified hardware sanitization, secure disposal, and data destruction in accordance with DoD regulations and NIST SP 800-88 guidelines

3.4 Cybersecurity and Information Assurance (IA) Compliance

· DoD RMF and System Authorization: Active maintenance of cybersecurity documentation and security controls within the Enterprise Mission Assurance Support Service (eMASS) to support DeCA’s system Authorization to Operate (ATO).

· Vulnerability & Patch Management: Rapid testing and deployment of Information Assurance Vulnerability Alerts (IAVAs), security bulletins, and operating system security updates within mandatory DoD timelines (typically within 21 calendar days of release).

· Security Hardening: Implementation and validation of Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) across mobile devices, management servers, and relational databases.

· Access Control & Workforce Standards: Integration with DoD Public Key Infrastructure (PKI), multi-factor authentication (CAC/PIV compatibility), and assignment of qualified personnel meeting DoD 8140/8570 cybersecurity workforce requirements.

3.5 Life-of-Contract Technology Refresh (Optional CLINs)

· Periodic Hardware Modernization: Pre-priced, optional contract line items (CLINs) executable over base and option years to procure replacement enterprise handheld terminals, updated battery fleets, and next-generation charging docks when fielded equipment reaches End-of-Life (EOL), End-of-Sale (EOS), or battery capacity degradation thresholds.

· Turnkey Provisioning of Refresh Units: Firm-fixed-price services to image, stage, test, asset-tag, ship, and commission next-generation devices, ensuring backward compatibility with established MDM profiles and store-level applications.

4.0 REQUESTED INFORMATION

Interested industry partners are requested to submit a comprehensive capability statement addressing the following areas in a single, consolidated response:

4.1 Corporate Profile

· 4.1.1 Company overview including Name, Address, Point of Contact (Name, Title, Email, Phone), CAGE Code, and Unique Entity Identifier (UEI).

· 4.1.2 Business size and socioeconomic classifications under NAICS 541519 or 541512.

· 4.1.3 Active federal contracting vehicles (e.g., GSA MAS, NASA SEWP V, CIO-SP3/4) where your hardware, software licensing, and professional services are currently available.

· 4.1.4 Relevant OEM partner credentials (e.g., Zebra Premier/Authorized Partner, SOTI Certified Solution Partner/Reseller).

4.2 Comprehensive Technical Capabilities & Integration Approach

· 4.2.1 MDM Architecture & Software Reseller Capability: Describe your approach to delivering and administering enterprise SOTI MobiControl client subscriptions (~2,709 endpoints) and dedicated server infrastructure (production and test enclaves). Highlight your licensing model flexibility, such as transitioning between perpetual and annual subscription terms, scaling seat counts dynamically, and preventing duplicate licensing charges during hardware transitions.

· 4.2.2 System Staging & Enterprise Integration: Describe your technical methodology for staging, configuring, and remotely administering large fleets of ruggedized Zebra Android mobile devices. Detail your experience integrating mobile devices with complex enterprise retail, inventory, and warehouse back-office solutions, including wireless barcode scanning, mobile receipt/label printing, and remote device profile distribution.

· 4.2.3 Global Hardware Maintenance & Advanced Sparing Depot: Outline your standard commercial approach for depot maintenance, warranty administration, and advance exchange sparing. How does your organization handle return-and-replace logistics across both domestic (CONUS) and overseas (OCONUS) military installations, including customs clearances and rapid spare fulfillment?

· 4.2.4 Enterprise Support & Service Level Standards: Describe your standard technical support operations and commercial Service Level Agreements (SLAs) for enterprise mobile device management. Outline your standard commercial thresholds for initial incident response, technical troubleshooting, and issue resolution for mission-critical versus general operational issues.

· 4.2.5 Federal Cybersecurity Compliance: Summarize your experience and methodology for supporting DoD Risk Management Framework (RMF) requirements, maintaining system ATO documentation (e.g., eMASS), executing DISA STIG hardening on mobile endpoints and server hosts, and delivering certified security patches within aggressive timelines (e.g., within 21 days). Confirm your capability to staff personnel certified under DoD 8140/8570 standards.

· 4.2.6 Brand Neutral Endpoint Management Capabilities: Describe whether your proposed MDM architecture supports brand‑agnostic management across heterogeneous endpoints (e.g., Zebra HHTs, mobile printers, iOS devices, Android tablets and phones). Identify any components of your solution that rely on brand‑specific tooling, agents, or proprietary interfaces, and explain the operational impacts of those dependencies.

4.3 Life-of-Contract Technology Refresh & Commercial Pricing Approaches

· 4.3.1 Tech Refresh CLIN Structuring: From an industry perspective, what is the most effective contract mechanism to structure multi-year optional CLINs for purchasing replacement handhelds when fielded units reach EOL/EOS? How can the Government best account for commercial price adjustments and newer model introductions across a multi-year ordering period?

· 4.3.2 Lead Times & Batch Deployments: What are standard industry lead times for procuring, imaging, staging, and deploying replacement batches of rugged enterprise terminals (e.g., tranches of 250 to 1,000+ units)?

· 4.3.3 Trade-In & Decommissioning Strategies: Describe commercial options or best practices regarding equipment buy-backs, residual value credits, and secure hardware disposition/data sanitization conforming to DoD 5200.01 and NIST SP 800-88 guidelines.

· 4.3.4 Budgetary Rough Order of Magnitude (ROM): Provide non-binding, budgetary estimates or commercial price benchmarks for:

· Annual SOTI MobiControl subscription license (per device/year).

· Dedicated server instance setup and annual operational maintenance.

· Turnkey device staging, imaging, and logistics delivery (per unit fee).

· Unit cost baseline for rugged enterprise Android mobile terminals with base accessories.

5.0 RESPONSE INSTRUCTIONS

· Format: Single PDF or Microsoft Word document, not to exceed 15 pages (11-point font, 1-inch margins). Reseller certificates, standard commercial product sheets, or past performance summaries may be attached as non-counting appendices.

· Primary NAICS Code: 541519 (Other Computer Related Services / Information Technology Value Added Resellers) / 541512 (Computer Systems Design Services).

· Accessibility: All proposed software, hardware interfaces, and technical support services must conform to Section 508 of the Rehabilitation Act. Respondents should indicate availability of Accessibility Conformance Reports (ACRs/VPATs).

· Submission Details:

· The Government is seeking a comprehensive integrated solution

· Used or refurbished products: No (All proposed hardware, spares, and replacement units must be new OEM equipment).

· Authorized Resellers / Partners: Required (Respondents must be authorized resellers/integrators of the proposed software and hardware manufacturers).

Additional Options:

· Do we require the contract holder to provide an Accessibility Conformance Report to address section 508 of the Rehabilitation Act? Yes (it’s a requirement that Federal Agencies ensure their IT is accessible to people with disabilities.

· Do you require the responses be from authorized/approval resellers? Yes (always)

· Allow Vendor Q&A? Yes, ensures we can clear up ambiguities/confusion.