DA01--Controlled Unclassified Information (CUI) (VA-26-00041445)

The Department of Veterans Affairs Technology Acquisition Center intends to solicit services for Controlled Unclassified Information (CUI) program implementation and sustainment, with a response deadline originally set for April 2, 2026, though a modification issued September 16, 2026 placed the effort on hold indefinitely with no current acquisition strategy.

No set-aside is contemplated. Work shall be performed virtually or at the VA facility in Washington, DC, with no travel anticipated. The contractor must comply with extensive federal security requirements including zero trust security controls, Federal Identity Credential and Access Management (FICAM) standards with PIV-card enabled authentication at IAL3/AAL3/FAL3, IPv6 support, and Trusted Internet Connection (TIC) 3.0 protocols. All contractor personnel require background investigations, VA security training completion, and signed Rules of Behavior before accessing VA information systems.

The scope covers a 12-month base period with four optional 12-month renewal periods plus two optional tasks (web-based training and 60-day transition support), with a total contract duration not exceeding 60 months. Deliverables include tailoring VA-specific CUI policy; developing and updating VA CUI Directive, Handbook, and process guides with quarterly policy reviews; reviewing and documenting the VA enterprise information system portfolio (700+ systems) to identify CUI-impacted systems; developing electronic marking solutions and phased implementation plans; establishing and maintaining a self-inspection program; developing incident management procedures and a CUI Compliance Dashboard; and developing tailored web-based training materials.

The RFI requested capability statements addressing draft PWS technical sufficiency, applicable contract vehicles, business size status under NAICS 541611, 50% small-business performance confirmation if applicable, proposed labor categories with estimated annual hours, and past performance specifically in reviewing VA IT system inventories and identifying systems requiring CUI reporting inclusion. Contracting office is located in Eatontown, New Jersey. Primary contact is Contract Specialist Michael Gruen (michael.gruen@va.gov, 848-377-7251).