5860--Varian FullScale on Premise Base plus 4 Option Years (VA-26-00050018)

The Department of Veterans Affairs, through its Technology Acquisition Center in Eatontown, NJ, issued a Request for Information (RFI) under solicitation number 36C10B26Q0255 to gather market data for a planned sole-source acquisition of the Varian FullScale on Premise Base solution plus four option years. This RFI, dated March 11, 2026, and with a response deadline of March 18, 2026, is strictly for planning purposes and does not constitute a solicitation or obligation to award a contract. Market research, including responses to this RFI and subsequent vendor engagements, has indicated that no alternative vendor exists capable of meeting the government’s technical and interoperability requirements, leading to the intent to proceed with a sole-source procurement. The scope of work requires the delivery and ongoing maintenance of an IT hosting solution supporting Varian software applications and server infrastructure on VA-owned property, with mandatory 24/7 monitoring and strict compliance with federal cybersecurity standards including FIPS 140-2, NIST SP 800-52, Zero Trust Architecture, VA Technical Reference Model (TRM), and TIC 3.0. Respondents must demonstrate technical expertise, corporate experience, and the ability to meet set-aside requirements, with submissions limited to 10 pages and 5 MB in size, delivered exclusively via email to designated VA points of contact. All deliverables must be secured and shipped to the designated delivery location in Indianapolis, IN, using tamper-evident packaging and trusted shipping channels with full chain-of-custody documentation. Software and firmware must be free of malware, include an NTIA-compliant Software Bill of Materials (SBOM), and be FIPS 140-2 compliant. Contractors are responsible for supplying all necessary licenses and ensuring full Section 508 ICT accessibility compliance. Critical security controls require immediate remediation of vulnerabilities within seven days for critical exposures and thirty days for non-critical ones, along with documented patch management and automated remote key management systems. Contractor personnel must be U.S.-based, undergo VA-access clearance verification per Tiered levels, sign the VA Information Security Rule of Behavior, and comply with NISPOM and VA Directive 0710. Any personnel changes, including termination or loss of clearance, must be reported within 24 hours. Media containing VA data must be sanitized using approved methods or returned under a Business Associate Agreement. The contract structure includes