DA10--Alternative to BigFix Endpoint Management (VA-26-00012805)

The Department of Veterans Affairs is transitioning its Enterprise Server Endpoint Management system from BigFix to a modern SaaS or hybrid SaaS solution through an acquisition strategy that will issue a Request for Quotation under NASA SEWP, a Government-Wide Acquisition Contract that allows daily product additions. The acquisition is structured as a Service-Disabled Veteran-Owned Small Business (SDVOSB) set aside under NAICS code 541519, with market research confirming multiple qualified SDVOSB resellers are available. The requirement demands a comprehensive endpoint management platform capable of supporting up to 150,000 endpoints across on-premises, AWS, and Azure environments, with core capabilities including cross-OS patch management, real-time compliance monitoring, offline support, third-party patch integration, role-based access control, vulnerability correlation, automation at scale, and strict adherence to federal compliance standards such as FISMA, Section 508, NIST frameworks, and VA Directive 0710. The solution must integrate with existing VA systems including ServiceNow, CDM, and NAC, and support Authority to Operate documentation, disaster recovery planning, and continuous monitoring. Performance will be conducted remotely at the contractor’s facility with no anticipated travel, over a 12-month base period and up to five optional 12-month periods, for a maximum potential duration of 72 months. Key deliverables include a Contractor Project Management Plan, monthly activity and inventory reports, a disaster recovery plan, compliance documentation, and a Security Assessment Plan and Report from a Third-Party Assessment Organization. Contractors must adhere to rigorous security and personnel requirements, including background investigations for all staff, encrypted Social Security Number handling, e-QIP initiation within three business days, PIV credential necessity, and strict prohibitions on unapproved media use or data transfer outside secure channels. The supply chain must ensure product authenticity through OEM or authorized reseller procurement, with Software Bill of Materials, cryptographic hashes, tamper-evident packaging, and chain-of-custody documentation required for all hardware and software. All submissions must be electronic, formatted per VA standards, and adhere to a 10-page capability statement limit. The Point of Contact is Contract Specialist Angel Santos, with the solicitation targeted for posting in May 2026, following an earlier RFI process that concluded in February 2026 and included feedback on the Performance Work Statement.