DA01--Health Services DevSecOps, NEW CONTRACT (VA-26-00011357)

The Department of Veterans Affairs through its Technology Acquisition Center in Eatontown, New Jersey, is seeking industry input for Health Services DevSecOps support under solicitation number 36C10B26Q0163, with the project identifier VA-26-00011357. This is a Request for Information (RFI) intended for planning purposes only and does not constitute a solicitation or a commitment to award a contract. The RFI seeks detailed information from vendors on their experience scaling Agile DevSecOps methodologies to support the modernization and sustainment of veterans' healthcare IT systems, with specific emphasis on expertise in VistA and MUMPS programming, product line management, team structuring, onboarding processes, and the use of low-code/no-code platforms and healthcare AI solutions. Vendors are required to respond within a 10-page limit, excluding recommendations related to Scrum team structure and the Performance Work Statement, and must avoid any marketing materials. The response deadline has been extended to February 12, 2026, at 10:00 a.m. Eastern Time, with submissions due via email to three designated VA addresses or through the ATOMS portal, and must not exceed 5 MB in size. The performance work statement outlines the need for continuous development, testing, deployment, and sustainment of health services applications using DevSecOps and Agile practices aligned with VA and federal standards including FedRAMP, VA Cloud-First Policy, OMB M-24-04, and Section 508 accessibility requirements. Contractors must support full lifecycle activities across VA’s Digital Service Handbook and Enterprise Architecture, deliver specified documentation such as Version Description Documents, Test Plans, and Cloud Usage Reports, and maintain compliance with VA’s Identity and Access Management policies. All personnel must meet designated sensitivity tiers, undergo background investigations per VA Handbook 0710, sign agreements protecting sensitive information, and ensure no organizational conflicts of interest occur. The contract will be awarded to a certified Service-Disabled Veteran-Owned Small Business under a total set-aside as specified in VAAR 852.219-73, with payments to non-certified subcontractors capped at 50% of total contract value. Evaluation will be based on trade-off analysis across technical quality, schedule adherence, staffing expertise, and management capability, with acceptable performance requiring a "Satisfactory or higher" rating across all factors. Security requirements are extensive, including vulnerability scanning