DA10--Integrated eNotifications Service Pilot via Direct Secure Messaging (VA-26-00049664)

The Department of Veterans Affairs is soliciting proposals for the Integrated eNotifications Service Pilot via Direct Secure Messaging under solicitation number 36C10B26Q0383, issued as a presolicitation through the GSA Multiple Award Schedule under NAICS code 541519. The initiative aims to implement a SaaS-based solution to enable real-time Admissions, Discharge, and Transfer notifications across VA Medical Centers using Direct Secure Messaging, with all work performed remotely at contractor facilities. The period of performance is 12 months from the date of award, and proposals must be submitted via email by 2:00 PM EST on May 4, 2026, limited to 15 pages and not exceeding 5 MB in total file size. Respondents must hold a Unique Entity Identifier and declare their business size status, with preference given to Service-Disabled Veteran-Owned Small Businesses and Veteran-Owned Small Businesses registered in the SBA VetCert program. Full and open competition is anticipated, with no set-aside designation and no firm contract value specified due to the presolicitation status. Compliance with stringent federal and VA-specific security requirements is mandatory, including FedRAMP HIGH authorization, FISMA, HIPAA, VA Zero Trust Security Controls, and NIST SP 800-52 standards. All software must include a compliant Software Bill of Materials in SPDX or CycloneDX format, encrypted using FIPS 140-2 validated methods, and delivered with tamper-evident packaging and chain-of-custody documentation. Personnel must undergo background investigations per VA Handbook 0710 at Tier 1, 2, or 4 levels, obtain PIV credentials, completeVA-specific training, and remain permanently located within the U.S. or its territories. The contractor must submit a Staff Roster within three days of award, immediately revoke access upon any personnel change, and report security incidents within one hour. Deliverables include a FedRAMP System Security Plan, VA Implementation Diagram, 3PAO Security Assessment Plan and Report, Monthly POAMs, and ADT System Metrics Reports. Inspection and acceptance by the Government will verify Section 508 compliance using WCAG 2.0 Level AA standards. No contract options are specified, and the Government retains full authority to conduct audits, inspections, and require destruction or return of all VA data upon completion. All communications must reference the solicitation title in the email subject line and be sent to