J049--VA-26-00045201 New VA Central Office (VACO) PACS Maintenance Contract

The Department of Veterans Affairs, through its Technology Acquisition Center in Eatontown, New Jersey, is seeking information for the maintenance of Physical Access Control Systems (PACS) across multiple National Capital Region facilities, including Sensitive Compartmented Information Facilities (SCIFs). This sources-sought notice, issued under solicitation number 36C10B26Q0500 and NAICS code 541519, aims to gather market intelligence to inform a future procurement with a base performance period of 12 months and four optional one-year extensions, potentially extending the contract to a maximum of five years. The scope of work requires comprehensive preventive, corrective, and remedial maintenance of PACS hardware, software, and administrative functions, including system upgrades, troubleshooting, and component replacements, all delivered in strict compliance with federal and VA-specific security standards such as FIPS 201-1, NIST SP 800-73/116, HSPD-12, Section 508, and VA Directive 6008. Contractors must support the continuous operability of these systems while adhering to Zero Trust architecture and Federal Identity frameworks, and deliver a suite of technical reports including an Initial PACS Assessment Report, System Mitigation Report, Weekly Progress Reports, and Maintenance Visit Reports, all in approved electronic formats. Personnel assigned to this contract must meet rigorous security and certification criteria, including active Top Secret/SCI clearances for SCIF access, and on-site technicians must be Lenel Certified Associate and Professional certified with locksmith experience and active VA PIV credentials. Contractors are required to maintain current authorized reseller status for all supported systems such as Lenel OnGuard and Victor Unified. Critical operational mandates include 24/7 emergency recall availability, chain-of-custody documentation for all equipment, tamper-evident packaging, non-return of electronic media without explicit VA approval, and mandatory Sanitization of data storage devices using VA-approved methods. The contract imposes strict supply chain controls requiring OEM-sourced equipment, complete Software Bill of Materials compliance, FIPS 140-2 validated cryptography, and emergency re-keying within 30 business days. System integrity is enforced through mandatory patch management—with critical vulnerabilities remediated within seven business days—prohibitions on USB media and Bluetooth devices, encrypted WAN traffic, and zero tolerance for malware. All submissions must be consolidated into a single 10-page narrative addressing company background, experience, risk management,