DA01- NBEKRSS (VA-26-00031146) Professional Service - Network Based Encryption Key Recovery Storage Solution

The Department of Veterans Affairs is conducting market research through a Request for Information (RFI) to assess the availability of commercial solutions for renewing software maintenance and support of its Network-based Encryption Key Recovery Storage System (NBEKRSS), an on-premises cryptographic key management solution operated within VA’s internal infrastructure. This RFI is strictly for planning purposes and does not constitute a solicitation, nor does it obligate the government to award any contract or provide funding; no funds have been authorized or appropriated for this effort. Respondents must submit responses no later than March 23, 2026, via email to the designated VA points of contact, with the subject line clearly stating “Network-based Encryption Key Recovery Storage System,” and submissions must not exceed 15 pages or 5 MB in file size. Marketing materials and generic capability statements are prohibited; responses must directly address the technical requirements outlined in the attached Draft Product Description, including specific details on the vendor’s product architecture, licensing model, patching procedures, and technical support framework—all tailored to VA’s operational constraints. Vendors must confirm their solution operates exclusively on-premises without cloud dependence, supports a customer-applied update model with no external contractor access required, and complies with FIPS 140-2 or 140-3 validated cryptographic modules, Federal PKI policy, NIST standards, Section 508 accessibility, and VA’s technology reference model. The NAICS code for this requirement is 541519 with a size standard of $34 million in annual revenue, and vendors must self-certify their small business or socioeconomic status, including SDVOSB or VOSB verification through the SBA’s database. Technical support must enable troubleshooting, log collection, and diagnostic exports without any remote access to VA networks, and maintenance cycles must include processes to validate updates in offline environments to prevent disruption of cryptographic workflows. Submissions must include company details such as name, address, CAGE code, UEI, business size, and existing contract vehicles, and all information must be marked as proprietary if business sensitive. The government will not pay for responses, and no procurement decision will result from this RFI.