DJ10--Data Monitoring and Sensing - Structured Data - RFI (VA-26-00050089)

This notice is a Request for Information (RFI) issued by the Department of Veterans Affairs, Technology Acquisition Center in Eatontown, NJ, under solicitation number 36C10B26Q0249, aimed at gathering industry input on a Zero Trust Data Monitoring and Sensing solution for structured data protection across VA on-premises and cloud environments. The RFI, classified as a sources-sought notice, does not constitute a solicitation or commitment to award a contract and is strictly for market research purposes. Respondents must submit responses by April 24, 2026, via email to designated contracting personnel, limited to ten pages with no marketing materials permitted. The submission must include the company’s SAM Unique Entity ID, CAGE code, business size, socioeconomic status, NAICS code 541519, and contact details in the opening paragraph. Offerors must declare any SDVOSB, VOSB, HUBZone, 8(a), or WOSB status and provide verification for veteran-owned claims. Use of AI or LLMs in proposal preparation or solution development requires a detailed attestation, documentation of system operations, change disclosure plans, and compliance with OMB M-26-04 and Executive Order 14319, including unclassified AI model rights transfer to the Government. The solution must comply with FedRAMP, NIST SP 800-53, FIPS 140-2/3, CIS benchmarks, FISMA, WCAG 2.1 AA, Section 508, and VA-specific security policies. Key deliverables include the Contractor Project Management Plan, Deployment Plan, Integration Status Reports, Zero Trust Efficacy & Operations Reports, and monthly POAM reports, evaluated against performance metrics such as data element categorization rates, system uptime (targeting 99.95%), training completion rates, reduction in unauthorized data transfers, and integration timelines. Security requirements mandate tamper-evident packaging and chain-of-custody for physical deliveries, encryption using FIPS-validated modules, patching within seven days for critical vulnerabilities, and strict data ownership retention by the Government, including destruction of all media within 30 days of contract termination. Contractors must meet VA employee-equivalent background standards for access, prohibit use of unauthorized AI tools with sensitive data, and deliver all custom-developed source code and documentation with unlimited rights per the SHARE IT Act. No pricing,