Access Control System in Defense Health Agency (DHA) Facilities

The Defense Information Systems Agency (DISA) is issuing a Request for Information on behalf of the Defense Health Agency (DHA) regarding access control systems for DHA medical treatment facilities, with responses due by May 29, 2026.

This is market research only and does not constitute a binding commitment to solicit or award a contract. DISA seeks vendor input on access control system design, capabilities, security posture, and lifecycle support to establish an enterprise standard for consistent deployment across DHA facilities. The RFI aims to align a standardized access control system profile with Department of Defense IT cybersecurity, interoperability, and sustainment requirements.

Vendors must submit white paper responses not exceeding 50 pages (single-spaced, 12-point font, one-inch margins) and 5 MB total file size. Key information requested includes system architecture and deployment modes; Risk Management Framework authorization status; DoD network compatibility and communication interfaces; authentication and authorization capabilities including zero-trust support; handling of personally identifiable information (PII) and electronic protected health information (ePHI); FIPS 140-3 and encryption standards compliance; patching and vulnerability management processes; remote maintenance access controls and support for government-furnished endpoint protection tools; Operational Technology security requirements aligned with the Purdue Model framework; and supply chain risk management compliance with DFARS 225.1101 Buy American requirements.

Questions are accepted until May 21, 2026. Responses should be emailed to Jennifer Everly and Son M. Pham at DISA. The Government will not reimburse respondent submission costs, and all submitted information becomes Government property.