DA10--Fast IDentity Online 2 Solution Brand Name or Equivalent RFI Loopback (VA-26-00064800)

The Department of Veterans Affairs, through its Technology Acquisition Center in Eatontown, NJ, is conducting a sources sought activity under solicitation number 36C10B26Q0466 to explore marketplace capabilities for a Fast IDentity Online 2 (FIDO2) authentication solution. The request aims to gather information on vendors capable of delivering FIDO2-compliant multi-factor authentication systems integrated with VA’s cybersecurity infrastructure, including FedRAMP-authorized SaaS platforms, CyberArk privileged access management, and support for USB-A and USB-C hardware tokens. The response deadline has been extended to June 4, 2026, at 1:00 PM EDT, with proposals limited to 10 pages and a 5 MB file size, to be submitted exclusively via email to designated VA contracting officers. The solicitation is not a binding contract award but serves as a market research tool to inform future procurement decisions. The technical scope requires full compliance with Section 508 accessibility standards, VA’s Trustworthy AI Framework, and a range of federal and VA-specific security directives including FIPS 140-2 encryption, NIST 800-37, DISA STIGs, and the Privacy Act of 1974. Deliverables include AI system documentation such as Model Cards, Acceptable Use Policies, change disclosure protocols, and compliance monitoring plans. Personnel must meet strict security requirements, including background investigations aligned with Tier 1, Tier 2, or Tier 4 risk designations, submission of SSNs and fingerprint records, and adherence to VA-specific forms and reporting timelines. Contractors must be U.S.-based, with no offshore performance allowed without prior written approval, and all physical and electronic deliveries require tamper-evident packaging, encrypted transmission, chain-of-custody tracking, and malware screening. The potential contract would include a base period of one year with four optional one-year extensions, totaling up to five years, with CLINs established for virtual servers, backup systems, device subscriptions, backend support, and maintenance services, though no pricing is provided in this RFI. Offerors must declare their size status under NAICS 541519, and SDVOSB/VOSB status verification through SBA’s VETCert program is mandatory if claimed. Evaluation is expected to favor technically superior proposals that demonstrate robust risk mitigation, AI transparency, and seamless integration with VA systems, with award likely based on a trade-off methodology rather than lowest