DA10--Enterprise Vulnerability Management Maintenance and Support (VA-26-00048094)

Closed Pre-Solicitation Posted

Solicitation number
36C10B26Q0482
Agency
Responses due
Set-aside
Service-Disabled Veteran-Owned Small Business

Opportunity facts

Notice details come from SAM.gov. Updated .

About this opportunity

The Department of Veterans Affairs Technology Acquisition Center intends to solicit a Firm Fixed Priced Task Order for Enterprise Vulnerability Management Maintenance and Support via NASA SEWP, with an RFI response deadline of June 4, 2026 and a subsequent solicitation posted under RFQ 36C10B26Q0311 with a June 25, 2026 deadline. The procurement is set aside for Service-Disabled Veteran-Owned Small Business (SDVOSB).

Following RFI evaluation, the Government has determined that only Tenable products meet stated requirements, with no alternative sources identified as capable of fulfilling the need. The solicitation is therefore designated as brand-name Tenable for the SDVOSB set-aside.

The VA requires enterprise vulnerability management capability supporting authoritative vulnerability scanning, compliance scanning, authenticated endpoint visibility, vulnerability reporting, and operational support for the VA Cybersecurity Operations Center Vulnerability Scanning Services. The VA currently operates approximately 1.8 million IP addresses with 675,000 FedRAMP Moderate agent subscriptions. The requirement includes BOD 23-01 twice-monthly Asset Vulnerability Scans, Payment Card Industry compliance scans, external vulnerability scans, Authority to Operate assessments, Security Control Assessments, and Inspector General remediation scans.

The contract covers a base year (July 1, 2026–June 30, 2027) plus three optional years through June 30, 2030. The baseline configuration includes Elite Support, Tenable.SC+ with 1.8 million IP bands, three Standard Tenable.SC Consoles, five Additional Console Subscriptions, a Tenable.SC Director, Continuous View monitoring, and FedRAMP Moderate agents (300,000 renewal and 375,000 new IP bands for the base year, expanding to 675,000 for option years).

Offerors must identify whether they propose maintenance of existing architecture, new commercial solution, or hybrid approach with detailed transition plans. All deliverables must comply with Section 508 accessibility standards (WCAG 2.0 Level A and AA), support IPv6 and dual-stack connectivity, discontinue Social Security Numbers as primary identifiers in favor of Integrated Control Numbers, and protect VA sensitive information per System Security Plans and Authority to Operate documentation.

Place of performance: distributed environments throughout the VA. Point of contact: Joshua McGarry, Contract Specialist, Joshua.McGarry@va.gov, 848-377-5136.

Notice text

2 versions

Update #2 · Latest ·

Subject: RFI Results and Notice of Intent Brand Name Tenable Solution

The Government issued a Request for Information (RFI) to determine whether any source could satisfy the Government's requirements for Enterprise Vulnerability Management Maintenance and Support (VA-26-00048094).

After review and evaluation of all responses received, the Government has determined that only Tenable products meet the Government's stated needs. No alternative source was identified through this RFI that could fulfill the requirement.

Based on these results, the Government has posted a solicitation via NASA SEWP under RFQ 36C10B26Q0311 for the brand name Tenable solution as a Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside.

Interested parties are directed to NASA SEWP for the full solicitation, requirements, and submission instructions.

This notice is for informational purposes only and does not constitute a commitment by the Government.

Update #1 ·

Page 12 of 12

Page 1 of 12

This is a Request for Information (RFI) only issued for the purpose of conducting market research. Accordingly, this RFI constitutes neither a Request for Quote (RFQ) nor a guarantee that one will be issued by the Government in the future; furthermore, it does not commit the Government to contract for any services described herein. Do not submit a Quote. The Department of Veterans Affairs (VA) is not, at this time, seeking proposals or quotes, and therefore, will not accept, review, or evaluate unsolicited proposals or quotes received in response hereto. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted as a result of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or, reimburse expenses incurred for responses to this RFI. The information provided may be used by VA in developing its acquisition strategy and Product Description (PD). Any information submitted by respondents to this RFI is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the respondent. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. This is a request for information and does not obligate the Government in any way, nor does it commit the Government to any specific course of action.

The VA Technology Acquisition Center (TAC) is seeking response to develop its acquisition strategy for a proposed Firm Fixed Priced Task Order for Enterprise Vulnerability Management Maintenance and Support. See attached draft Product Description.

Provide Responses to the following:

A. General Company Information

1. Include the following identification information

a. Company Name

b. CAGE/DUNS Number under which the company is registered in SAM/VetBiz.gov

c. Company Address

d. Point of contact name

e. Telephone number

f. Email address

g. GWAC Contract Number if any

h. Socio-economic size under NAICS Code 541519. For Service Disabled Veteran Owned Small Business (SDVOSB) or Veteran Owned Small Business (VOSB) concerns, advise if you are currently certified in the Vendor Information Pages Database (https://vip.vetbiz.va.gov/)

2. Based upon the requirements in the draft Product Description; provide any questions or recommended changes you may have to the draft Product Description.

B. Capability Statement

Submit a brief capability statement describing your company s ability to meet the requirements in the attached draft PD.

Confirm whether your proposed solution is Section 508 compliant and provide a current VPAT/ACR (Voluntary Product Accessibility Template/Accessibility Conformance Report). If any accessibility gaps exist, briefly note them and the planned remediation timeline.

Submit your RFI response to the above questions in accordance with the following:

1) No more than 10-page and no more than 5 MB.

2) Mark your response as Proprietary Information if the information is considered business sensitive.Â

3) NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. The Government will not review generic marketing materials that do not address the information contained herein or the attached document.

Submit the below requested information by 11:00 AM ET on June 4, 2026, via email to Contract Specialist Joshua McGarry at Joshua.McGarry@va.gov. VA reserves the right to not respond to any, all, or select responses or materials submitted. All current VA requirements identified herein or in the attached draft Product Description are subject to change at any time.

Files

File Type Posted
36C10B26Q0482_1.docx DOCX document
PD_DRAFT_Enterprise_Vulnerability_Management_Open_Spec_5_28_26.pdf PDF
36C10B26Q0482.docx DOCX document

Similar open opportunities

Opportunity Agency Set-aside Responses due
DA10--New Action: TIC Application Firewall Maintenance Renewal (VA-27-00009587) NAICS 541519 VA Technology Acquisition Center Service-Disabled Veteran-Owned Small Business
DA01--CORP: VCS Standalone IT Support Contract - RFI (VA-27-00012857) NAICS 541519 VA Technology Acquisition Center No set-aside
DA10--RFI VHA Radiology and Cardiology Enterprise Imaging NAICS 541511 VA Technology Acquisition Center No set-aside
Nexodose dose monitor Kansas City, Missouri, United States · NAICS 541519 Veterans Integrated Service Network 15 No set-aside
6515--NX EQ Image Guided Surgical Navigation System (VA-26-00083972) Nationwide · NAICS 334510 VA Strategic Acquisition Center Frederick Service-Disabled Veteran-Owned Small Business

On GovTribe

Work this opportunity

  • Track it in your pipeline
  • Find teaming partners
  • Similar opportunities
  • Ask GovTribe AI about this opportunity