DA10--Cority GX2 Brand Name or Equivalent Software as a Service Subscription (VA-26-00049891)

The government is seeking information through a sources-sought notice to explore the acquisition of Cority GX2 or an equivalent Software as a Service (SaaS) platform under a Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside, leveraging the NASA SEWP V contract vehicle. The intended solution will support the Department of Veterans Affairs’ Enterprise Occupational Safety and Health program by providing an integrated, cloud-based platform for safety reporting, analytics, mobile access, and real-time notifications across up to 470,000 users. The system must be configurable, consolidated, and capable of seamless API integration with existing VA systems, while meeting stringent requirements including FedRAMP Moderate authorization, VA Authority to Operate, Section 508 accessibility compliance (WCAG 2.0 Level AA), and adherence to the VA Trustworthy AI Framework and SHARE IT Act. The procurement is structured with a one-year base period and four one-year option periods, though no pricing, CLINs, or formal contract terms are included in this pre-solicitation RFI, which serves only as market research to inform future acquisition planning. Security and supply chain integrity are central to this effort, governed by custom clauses derived from VA Notice 24-12, which mandate cryptographic compliance using FIPS 140-2 validated modules, encrypted data transmission with FIPS-approved cipher suites, and the provision of a Software Bill of Materials (SBOM) in NTIA-compliant format. All software must be free of viruses, malware, and tampering, with chain-of-custody documentation required for any physical components, though delivery is primarily digital. The contractor must be permanently located within the U.S. or its territories, comply with U.S. export control regulations, and implement Zero Trust Security Controls. Personnel access to VA systems requires verification through VA’s VETCert program and adherence to VA Directive 0710, with mandatory reporting of personnel changes or security incidents within 24 hours or one hour for breaches. Respondents must certify SDVOSB status via SBA VETCert, provide a Unique Entity Identifier and CAGE code, and submit responses no longer than 10 pages via email to specified VA points of contact by June 30, 2026, with no formal award anticipated from this notice.