FY26 Request for Information, Hardware for Network

The Social Security Administration’s Office of Acquisition and Grants is seeking information through Request for Information 28321326RI0000038 to evaluate potential Commercial Off-The-Shelf solutions for modernizing its Network Intrusion Detection and Prevention Systems. This effort aims to enhance or replace legacy systems with capabilities that provide comprehensive visibility across hybrid environments—including on-premises, MPLS, cloud platforms like AWS and Microsoft 365, and third-party networks—while fully integrating with existing cybersecurity tools such as SIEM, SOAR, and UEBA. The solution must enforce Zero Trust Architecture, support Detection-as-Code using Sigma, Snort, and YARA rule formats, enable real-time processing with low latency and minimal packet loss, and ensure compliance with NIST SP 800-53 Rev. 5, FIPS 140-3, and OMB M-21-31 for logging maturity, along with FedRAMP authorization for any cloud-based components. Vendors must submit a Corporate Information Template detailing business size, socioeconomic status, federal contract vehicles, past performance, and third-party relationships, as well as a completed VPAT for accessibility, architecture diagrams, CI/CD pipeline descriptions, integration details, performance benchmarks, licensing information, and mappings to specific requirement codes. All submissions must be sent electronically via email to Sheri McLain at sheri.mclain@ssa.gov by August 20, 2026, with the solicitation number in the subject line, and only Word and PDF formats are implied for compatibility. The government has emphasized that this is strictly a market research tool and not a solicitation for proposals or a commitment to award a contract, with no pricing, line items, or contract value provided. However, future procurements may follow, potentially leveraging options for multi-year software licenses and maintenance. Special requirements include a strict prohibition on custom development, mandatory 24x7 technical support, IPv6 dual-stack compatibility, supply chain risk management practices, and the government’s unilateral right to exercise optional contract years without vendor restriction. No contract clauses, packaging requirements, or payment details are included as this document is preliminary and non-binding.