DA10--Enterprise Vulnerability Management Maintenance and Support (VA-26-00048094)
Closed Pre-Solicitation Posted
- Solicitation number
- 36C10B26Q0482
- Agency
-
VA Technology Acquisition Center
Headquarters, Department of Veterans Affairs
- Responses due
- Set-aside
- Service-Disabled Veteran-Owned Small Business
Opportunity facts
- NAICS code
- 541519 Other Computer Related Services
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The Department of Veterans Affairs Technology Acquisition Center intends to solicit a Firm Fixed Priced Task Order for Enterprise Vulnerability Management Maintenance and Support via NASA SEWP, with an RFI response deadline of June 4, 2026 and a subsequent solicitation posted under RFQ 36C10B26Q0311 with a June 25, 2026 deadline. The procurement is set aside for Service-Disabled Veteran-Owned Small Business (SDVOSB).
Following RFI evaluation, the Government has determined that only Tenable products meet stated requirements, with no alternative sources identified as capable of fulfilling the need. The solicitation is therefore designated as brand-name Tenable for the SDVOSB set-aside.
The VA requires enterprise vulnerability management capability supporting authoritative vulnerability scanning, compliance scanning, authenticated endpoint visibility, vulnerability reporting, and operational support for the VA Cybersecurity Operations Center Vulnerability Scanning Services. The VA currently operates approximately 1.8 million IP addresses with 675,000 FedRAMP Moderate agent subscriptions. The requirement includes BOD 23-01 twice-monthly Asset Vulnerability Scans, Payment Card Industry compliance scans, external vulnerability scans, Authority to Operate assessments, Security Control Assessments, and Inspector General remediation scans.
The contract covers a base year (July 1, 2026–June 30, 2027) plus three optional years through June 30, 2030. The baseline configuration includes Elite Support, Tenable.SC+ with 1.8 million IP bands, three Standard Tenable.SC Consoles, five Additional Console Subscriptions, a Tenable.SC Director, Continuous View monitoring, and FedRAMP Moderate agents (300,000 renewal and 375,000 new IP bands for the base year, expanding to 675,000 for option years).
Offerors must identify whether they propose maintenance of existing architecture, new commercial solution, or hybrid approach with detailed transition plans. All deliverables must comply with Section 508 accessibility standards (WCAG 2.0 Level A and AA), support IPv6 and dual-stack connectivity, discontinue Social Security Numbers as primary identifiers in favor of Integrated Control Numbers, and protect VA sensitive information per System Security Plans and Authority to Operate documentation.
Place of performance: distributed environments throughout the VA. Point of contact: Joshua McGarry, Contract Specialist, Joshua.McGarry@va.gov, 848-377-5136.
Notice text
2 versions
Update #2 · Latest ·
Subject: RFI Results and Notice of Intent Brand Name Tenable Solution
The Government issued a Request for Information (RFI) to determine whether any source could satisfy the Government's requirements for Enterprise Vulnerability Management Maintenance and Support (VA-26-00048094).
After review and evaluation of all responses received, the Government has determined that only Tenable products meet the Government's stated needs. No alternative source was identified through this RFI that could fulfill the requirement.
Based on these results, the Government has posted a solicitation via NASA SEWP under RFQ 36C10B26Q0311 for the brand name Tenable solution as a Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside.
Interested parties are directed to NASA SEWP for the full solicitation, requirements, and submission instructions.
This notice is for informational purposes only and does not constitute a commitment by the Government.
Update #1 ·
Page 12 of 12
Page 1 of 12
This is a Request for Information (RFI) only issued for the purpose of conducting market research. Accordingly, this RFI constitutes neither a Request for Quote (RFQ) nor a guarantee that one will be issued by the Government in the future; furthermore, it does not commit the Government to contract for any services described herein. Do not submit a Quote. The Department of Veterans Affairs (VA) is not, at this time, seeking proposals or quotes, and therefore, will not accept, review, or evaluate unsolicited proposals or quotes received in response hereto. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted as a result of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or, reimburse expenses incurred for responses to this RFI. The information provided may be used by VA in developing its acquisition strategy and Product Description (PD). Any information submitted by respondents to this RFI is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the respondent. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. This is a request for information and does not obligate the Government in any way, nor does it commit the Government to any specific course of action.
The VA Technology Acquisition Center (TAC) is seeking response to develop its acquisition strategy for a proposed Firm Fixed Priced Task Order for Enterprise Vulnerability Management Maintenance and Support. See attached draft Product Description.
Provide Responses to the following:
A. General Company Information
1. Include the following identification information
a. Company Name
b. CAGE/DUNS Number under which the company is registered in SAM/VetBiz.gov
c. Company Address
d. Point of contact name
e. Telephone number
f. Email address
g. GWAC Contract Number if any
h. Socio-economic size under NAICS Code 541519. For Service Disabled Veteran Owned Small Business (SDVOSB) or Veteran Owned Small Business (VOSB) concerns, advise if you are currently certified in the Vendor Information Pages Database (https://vip.vetbiz.va.gov/)
2. Based upon the requirements in the draft Product Description; provide any questions or recommended changes you may have to the draft Product Description.
B. Capability Statement
Submit a brief capability statement describing your company s ability to meet the requirements in the attached draft PD.
Confirm whether your proposed solution is Section 508 compliant and provide a current VPAT/ACR (Voluntary Product Accessibility Template/Accessibility Conformance Report). If any accessibility gaps exist, briefly note them and the planned remediation timeline.
Submit your RFI response to the above questions in accordance with the following:
1) No more than 10-page and no more than 5 MB.
2) Mark your response as Proprietary Information if the information is considered business sensitive.Â
3) NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. The Government will not review generic marketing materials that do not address the information contained herein or the attached document.
Submit the below requested information by 11:00 AM ET on June 4, 2026, via email to Contract Specialist Joshua McGarry at Joshua.McGarry@va.gov. VA reserves the right to not respond to any, all, or select responses or materials submitted. All current VA requirements identified herein or in the attached draft Product Description are subject to change at any time.
Files
| File | Type | Posted |
|---|---|---|
| 36C10B26Q0482_1.docx | DOCX document | |
| PD_DRAFT_Enterprise_Vulnerability_Management_Open_Spec_5_28_26.pdf | ||
| 36C10B26Q0482.docx | DOCX document |
Similar open opportunities
| Opportunity | Agency | Set-aside | Responses due |
|---|---|---|---|
| DA10--New Action: TIC Application Firewall Maintenance Renewal (VA-27-00009587) | VA Technology Acquisition Center | Service-Disabled Veteran-Owned Small Business | |
| DA01--CORP: VCS Standalone IT Support Contract - RFI (VA-27-00012857) | VA Technology Acquisition Center | No set-aside | |
| DA10--RFI VHA Radiology and Cardiology Enterprise Imaging | VA Technology Acquisition Center | No set-aside | |
| Nexodose dose monitor | Veterans Integrated Service Network 15 | No set-aside | |
| 6515--NX EQ Image Guided Surgical Navigation System (VA-26-00083972) | VA Strategic Acquisition Center Frederick | Service-Disabled Veteran-Owned Small Business |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity