Vendor Questions and Answers - OICM Services - 04-16-2026.xlsx

Sheet1 Vendor Questions and Answers

VA Office of Inspector General (VA OIG) Office of Investigations Case Management (OICM) Services

Request for Information (RFI) - RFI Notice ID Number: VAOIG-RFI-26-0001

The RFI is issued solely for information and market research purposes.

Please note that the Government is required to award all contract actions for Fiscal Year 2026 by September 30, 2026.

The RFI is issued solely for information and market research purposes.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

9 Attachment 1 - Draft SOW /Background What is the total number of records (cases, contacts, entities) currently in EMS that need to be migrated?

All data is expected to be migrated.

Vendors are also instructed to provide the “Total Price” for all periods combined.

A “Break-Out” of the elements of the Total Price for each period (for example, providing a price for Implementation Services, Licensing, Operations and Maintenance (O&M), etc.) is recommended to increase clarity / understanding, but is not required.

34 Technical Requirements 1.b. xxvi.2

There are multiple technical solutions available to the Government that may provide greater value if not incorporated into the core case management solution (the requirement seems unnecessarily limiting).

Platforms with AI natively integrated into the case data model produce operationally actionable responses; bolt-on AI produces document search results.

This distinction has significant implications for investigative effectiveness and should be defined as an evaluation criterion.

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

The RFI is issued solely for information and market research purposes.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

41 SOW Section 1.b.xxxi; Technical Requirements Will the Solicitation require that AI capabilities enforce the same role-based access controls (RBAC) that govern the rest of the platform — ensuring that AI-generated responses only surface case data, documents, and communications that the querying user is explicitly authorized to access?

For a law enforcement investigative environment handling undercover operations, confidential sources, and grand jury material, an AI system with unconstrained data access would represent a significant security and legal risk.

Will role-aware AI be a mandatory requirement?

Please refer to SOW para. 1.b.xxxi for guidance on AI capabilities.

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

The RFI is issued solely for information and market research purposes.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

42 SOW Section 1.b.ii; Technical Requirements Will VA OIG consider evaluating whether proposed AI capabilities are built on a structured investigative data ontology — a model of entities, relationships, and case actions — versus a general-purpose large language model applied to document text?

Platforms built on a structured investigative data model can surface specific relationships between subjects, entities, and prior cases automatically, which is directly relevant to OI's deconfliction and pattern analysis needs.

Please refer to SOW para. 1.b.xxxi for guidance on AI capabilities.

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

The RFI is issued solely for information and market research purposes.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

43 Technical Requirements, Section 1.b.xxxi – AI Capabilities The SOW states the system must be able to "scale to and/or incorporate" AI capabilities.

Can VA OIG elaborate on the near-term AI use cases of highest priority — for example, predictive case routing, automated entity extraction from documents, anomaly detection in financial data, or natural language search?

Understanding the priority AI roadmap will help Vendors demonstrate the depth and readiness of their AI/ML architecture.

Can VA OIG describe the current access control model in EMS (e.g., role-based, attribute-based, case-level ACLs)?

Specifically, how many distinct security roles/groups are anticipated, and is there a requirement for dynamic, case-by-case access grants (e.g., executive approval workflows) beyond standard RBAC?

VA OIG current access control in EMS is role-based. Access controls require be dynamic in nature in that on a case-by-case basis, data is comparmentalized to restrict unauthorized access to items not limited to undercover operations, grand jury material, and confidential sources. Access controls also require restrictive acces for investigations not limited to internal affairs or other sensitive investigations.

45 SOW Section 1.b.vii; Technical Requirements The SOW requires customizable, ad-hoc, and pre-built reports including recurring reports required by the Inspector General Act and CIGIE.

Will the Solicitation require that report generation — including automated population of data fields, attachment of exhibits, and scheduling of recurring outputs — be accomplished natively within the case management platform without requiring export to a separate reporting tool?

Platforms that require data export to BI tools like Power BI or Tableau to generate standard investigative reports introduce data integrity risk and add manual steps to a compliance-driven workflow.

The Government requires a CMS that can provide report generation that does not include additional third-party costs.

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

The RFI is issued solely for information and market research purposes.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

46 SOW Section 1.b.xi; Technical Requirements Will the Solicitation evaluate whether AI-assisted document drafting — including generation of investigative reports, referral letters, subpoena documents, and case summaries — is available natively within the platform using templates populated from live case data?

This capability eliminates manual transcription, reduces errors in sensitive investigative documents, and directly accelerates investigative timelines.

Are there specific PDF formatting, court-filing standards, or legal review workflows (e.g., attorney approval before issuance) that the system must support?

The IG subpoena generator has a workflow that starts from the criminal investigator, through supervisors, to attorney advisors for an approval workflow. Data fields required are not limited to type of request; investigator, case number, agent location, statutes violated, summary, description of records sought, how records will further investigation, timeframes, prosecutor coordination, account holder, VA employee status, provider address, and routing workflow.

The current generator starts with Microsoft Word and is finalized into a PDF document.

VA OIG attorney advisors provide the legal language required and updates to, dependent on the type of IG subpoena (General, HIPAA, FERPA, Right to Financial Privacy).

48 Technical Requirements, Section 1.b.xxvi – Link Analysis & Geospatial The SOW requires link analysis and geospatial mapping tools.

Can VA OIG clarify whether these analytical capabilities need to be natively embedded within the case management UI, or whether integration with existing external tools (e.g., Palantir, i2 Analyst's Notebook, ArcGIS) via API would satisfy this requirement?

Are there existing enterprise licenses for any geospatial or link-analysis platforms OIG wishes to preserve?

VA OIG is not considering leveraging a third-party solution at this time.

VA OIG will not provide additional information regarding enterprise licenses or link-analysis platforms at this time.

To ensure our implementation is configured to VA OIG's exact operational and compliance standards, can VA OIG confirm:

(1) whether SHA-256 is the required hash algorithm, or whether an additional or alternative algorithm (e.g., MD5 for legacy system compatibility) is needed;

(2) the anticipated annual data storage growth rate beyond the 10 TB baseline, so that capacity planning and cost projections across the period of performance accurately reflect OIG's evidence volume trajectory; and

(3) whether hash values must be displayed and accessible within the case record UI at the time of upload, or whether background generation with a confirmed hash record in the audit log is acceptable for chain-of-custody purposes?

The answers are as follows:

1) MD5 and SHA-1 would be needed for legacy systems.

2) No annual data storage growth rate beyond 10TB baseline is anticipated at this time Note that thiese numbers may change by the time a Solicitation is issued.

3) Confirmed hash value in the audit log is acceptable for chain-of-custody purposes.

51 Technical Requirements, Section 1.b.xviii – Vehicle Tracking The SOW includes a requirement to track Government vehicles including mileage by purpose (e.g., home-to-work), maintenance, accidents, and safety information.

Can VA OIG clarify whether this is intended to be a manual data-entry module within the CMS or whether integration with a telematics/GPS fleet management system is anticipated?

Understanding whether real-time GPS data ingestion is a future-state requirement will help Vendors scope the vehicle module appropriately.

This distinction affects both licensing cost and security architecture, particularly for law enforcement sensitive matters where external access must be tightly controlled and audited.

Additionally, will external users require PIV-based authentication, or will an alternative identity verification method (e.g., Login.gov, CAC) be acceptable?

325 concurrent users must have read/write access. The total expected number of external users is ten who will be VA OIG authorized. These will be comprised of prosecutors, potentially other law enforcement investigators, and peer review inspectors granted with temporary, read only access.

Refer to SOW para. 3.e for PIV-based authentication requirements.

54 SOW Section 2.a.i; Implementation The SOW references configuration, data migration, and training as Contractor responsibilities.

Can VA OIG clarify whether implementation services are intended to be included within the scope of this contract, or whether VA OIG anticipates acquiring implementation services through a separate contract vehicle?

Clarifying this distinction will allow Vendors to provide more accurate ROM pricing and scope their capability packages appropriately.

Can VA OIG rank these integrations by priority and describe the current data exchange mechanism for each (e.g., API, SFTP, database link)?

For Microsoft Power BI and Tableau, is the requirement a live data connector, scheduled export, or embedded analytics within the CMS UI?

The first system that must be integrated with the new OICM solution is EMS (SOR).

Integration priority with all other systems, platforms, and applications will be determined by OIG leadership after contract award.

56 Technical Requirements, Section 1.b.xx – Data Migration & API Can you describe the data schema and structure of the existing EMS system (e.g., table counts, data types, volume of records, file attachments)?

Specifically, will VA OIG provide a data dictionary or schema export for the legacy EMS .NET/SQL system prior to contract award to allow Vendors to accurately scope migration effort and risk?

VA OIG will provide a data dictionary of the legacy EMS system after award.

57 Technical Requirements, Section 2.a.iii – Data Migration Plan What is the approximate volume of legacy case records, hotline allegations, and congressional inquiries currently in EMS?

Are there associated document attachments (PDFs, images, audio/video) currently stored in EMS or a linked document store, and if so, what is the estimated total file storage volume to be migrated?

This will directly inform our migration timeline and validation approach.

Vendors with documented Government migration experience at scale present materially lower risk than those without it.

Will Past Performance on legacy Government data migration be a specific evaluation criterion?

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

The RFI is issued solely for information and market research purposes.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

59 Security Compliance, Section 2.b – FedRAMP / Private Cloud Is VA OIG's preferred deployment model a FedRAMP Moderate (or higher) authorized SaaS solution, or does OIG have a preference or requirement to deploy on a VA-provided private cloud?

If private cloud is selected, what infrastructure (cloud provider, region, IaaS layer) would VA OIG provide, and would the Contractor be expected to manage DevOps and patching within that environment?

Can VA OIG clarify whether the records retention requirement encompasses NARA-compliant disposition schedules, litigation holds, and FOIA-responsive records management — and whether the system must generate auditable records of retention actions and dispositions?

This will determine whether a platform's native records management architecture is sufficient or whether integration with a separate records management system is anticipated.

Can VA OIG confirm whether the Entra ID tenant supports SAML 2.0 and/or OIDC federation for third-party SaaS applications, and whether any additional MFA layers beyond PIV are required?

Additionally, will the Contractor be responsible for configuring the Entra ID enterprise application registration, or will VA OIG IT staff own that configuration?

Can VA OIG clarify the anticipated ceiling for scalability — i.e., the maximum user base for which the system must be architected and priced — so that Vendors can accurately scope licensing, infrastructure, and performance commitments for the base period and all option years?

Given this constraint, can VA OIG describe OIG's internal change management and user acceptance testing (UAT) capacity — specifically, how many OI subject matter experts (SMEs) can be dedicated to requirements validation, configuration workshops, and UAT during the implementation phase?

This will inform our sprint cadence and go-live readiness planning.

Can VA OIG define expected SLA response and restoration time targets by severity level (e.g., P1 critical / P2 high / P3 standard) so Vendors can confirm service-level commitments and structure support tiers accordingly?

Please refer to the SOW - Other Requirements, Section 5 (Page 11 to Page 12) for required Support Agreement (SA) elements.

No additional information will be provided regarding expected SLA response and restoration time targets by severity level.

65 Security Annex, Section 2.D – Suitability / Background Investigation The Security Annex requires a DCSA Tier 4 investigation for personnel with direct access to the legacy EMS system during migration, and Tier 2S for all other direct system access.

Can VA OIG clarify the anticipated number of Contractor personnel requiring each tier, and confirm whether conditional access (pending Tier 2S adjudication) will be granted upon completion of the initial SAC for non-EMS personnel to avoid delays to the implementation schedule?

No additional information will be provided regarding the following:

i. The anticipated number of Contractor personnel requiring each tier”; or

ii. Whether conditional access (pending Tier 2S adjudication) will be granted upon completion of the initial SAC for non-EMS personnel.

66 RFI Section 2; SOW Title and Scope The SOW specifies a COTS solution. Will the Solicitation evaluate the total cost of ownership (TCO) of proposed solutions over the full period of performance, including licensing, implementation, integration with existing tools, ongoing maintenance, and the cost of manual processes required to bridge gaps between point solutions?

Agencies that have consolidated onto a single unified commercial platform have documented significant reductions in total IT expenditure and staff administrative burden. Will TCO be an evaluation factor?

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

67 RFI Section 2; SOW Title and Scope The Executive Order on Ensuring Commercial, Cost-Effective Solutions in Federal Contracts directs agencies to prioritize commercial solutions.

Will the Solicitation allow VA OIG evaluators to assess the pace of platform innovation — specifically, the frequency and scope of feature releases, AI enhancements, and security improvements delivered within the subscription — as a factor in evaluating long-term value?

Commercial platforms on continuous deployment cycles deliver new capabilities on a timeline measured in weeks; purpose-built Government systems deliver them on procurement timelines.

This distinction becomes significant over a five-year period of performance.

Please note that this RFI is not a Solicitation or a promise to issue a Solicitation. No award(s) shall be issued from the responses to this RFI.

As a result, no information regarding a Solicitation, the evaluation process for a Solicitation, or the acquisition strategy will be provided.

The demonstration may include investigative scenarios, workflows, CMS capabilities, etc. based on the requirements in the SOW.

Integration priority with all other systems, platforms, and applications will be determined by OIG leadership after contract award.

Vendors are free to provide information on any approach / solution that meets the requirements of the SOW.

88 Knowledge Transfer and Training Will VA OIG consider Vendor‑proposed role‑based and train‑the‑trainer models that leverage configurable system workflows and dashboards to minimize user disruption during transition from the legacy EMS system?

Refer to SOW, Other Requirements, para. 6.

89 SOW, Non Technical Requirements - 3.f.i, Page 9 Can the Government please provide an estimate of the anticipated number of users for the system?

Additionally, could you outline the number of organizational units (e.g., Offices/Divisions) that will utilize the system and the approximate distribution of users across those units?

325 concurrent users must have read/write access.

No additional information will be provided regarding the number of organizational units or the distribution of users across those units.

90 SOW Section D. Assessment and Authorization - 3 Under Required System Environments, Method I requires the solution to be fully FedRAMP authorized as evidenced by an active Authority to Operate (ATO).

If a Vendor's COTS product is currently "In Process" for a FedRAMP High ATO with an anticipated completion date of June 2026, will the Government consider this acceptable for the purposes of the forthcoming Solicitation?

No. The solution must already be FedRAMP authorized.

91 Vendors are instructed to provide a Rough Order of Magnitude (ROM) for a Base Period of twelve (12) months and four (4) twelve (12) month Option Periods.

Can the Government confirm if this ROM pricing documentation counts toward the twenty-five (25) page limit for the Capability Package?

No. Rough Order of Magnitude (ROM) pricing documentation does not count toward the twenty-five (25) page limit for the Capability Package.

92 SOW, Technical Requirements 1 - xx, Page 4 Can the Government please answer the questions below regarding data migration:

a. How much data (in GB) is expected to be migrated (excluding attachments)?

b. Approximately how many files will be provided for import?

c. Is SFTP an acceptable method for secure data transfer?

d. Can you provide a database schema?

e. Can you provide a list of column headers for each table, or at minimum the number of columns?

f. How are records and files linked—via link tables or internal references?

g. Can sample data be shared (scrubbed or redacted if necessary)?

h. In what format will the data be delivered (e.g., CSV, Excel, JSON)?

i. Is the source system using a proprietary or uncommon data format?

j. Will the data include attachments such as images, videos, or PDFs?

k. If yes, what is the estimated volume and file types of these attachments?

The answers are as follows:

a. 24 GB, not including attachments. 574 GB including attachments.

b. No additional information will be provided regarding how many files will be provided for import.

c. SFTP is approved for use at the VA.

d. Data dictionary will be provided after award.

e. Data dictionary will be provided after award.

f. The table records are linked to the uploaded attached files via internal references.

g. No.

h. Data cannot be provided prior to award.

i. Source system is using Microsoft SQL Server.

j. Yes.

k. 574 GB, which includes, but is not limited to, images, pdfs, and various document types.

93 SOW Section 2.2.d, Page 6 Can the Government please elaborate on the phrase "project templates" as referenced in the SOW Section labeled as:

d. "developing and implementing project templates".

Project templates is synomynous with documentation.

94 SOW Section 2.2.i, Page 6 Can the Government please elaborate on the phrase "configuration management tool" as referenced in the SOW Section labeled as:

i. "The Contractor shall provide a Configuration Management tool to track changes and software release deployment."

Refer to SOW para. 2.2.i.

95 SOW Section: Technical Requirements - Subsection 2 -COTS ICMS - iii Data Migration

Can the Government provide the estimated size of the current EMS system (in TB), including structured data and unstructured attachments (documents, audio, video), along with the approximate number of cases, entities, and years of historical data to be migrated?

Additionally, has any data profiling or cleansing assessment been performed on the legacy EMS system?

Subsection 2 -COTS ICMS - I - Implementation and Configuration - Requirement 1 Can the Government confirm the number of required system integrations and identify which interfaces require real-time versus batch processing?

Additionally, will API specifications, data exchange formats, and access to external systems be provided by the Government?

Please note that Vendors are free to provide information on any approach / solution that meets the requirements of the SOW.

- it enforces a single-agency (OIG) private cloud meaning that it prevents access by any other entities, fully managed by OIG / vendor, and ensures the PaaS is FedRAMP certified.

In this case, an independent assessment must be completed, and an OIG-specific ATO granted before going into production.