7A21--RTLS Hand Held Application (VA-26-00077512)

Sources Sought Notice Sources Sought Notice Page 10 of 10 Sources Sought Notice Sources Sought Notice Page 1 of 10 SUBJECT* RTLS Hand Held Application (VA-26-00077512) GENERAL INFORMATION CONTRACTING OFFICE S ZIP CODE* 07724 SOLICITATION NUMBER* 36C10B26Q0702 RESPONSE DATE/TIME/ZONE 08-17-2026 14:00 CENTRAL TIME, CHICAGO, USA ARCHIVE 30 DAYS AFTER THE RESPONSE DATE RECOVERY ACT FUNDS N SET-ASIDE SDVOSBC PRODUCT SERVICE CODE* 7A21 NAICS CODE* 541519 CONTRACTING OFFICE ADDRESS Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 POINT OF CONTACT* Contract Specialist Juan C Perez Juan.Perez5@va.gov PLACE OF PERFORMANCE ADDRESS POSTAL CODE COUNTRY ADDITIONAL INFORMATION AGENCY S URL URL DESCRIPTION AGENCY CONTACT S EMAIL ADDRESS EMAIL DESCRIPTION DESCRIPTION THIS IS A Sources Sought Notice ONLY. The Department of Veterans Affairs (VA) intends to award a firm fixed price sole-source contract to AgileRank LLC., for Real Time Location System Asset Tracking Handheld Software Application on a sole source basis. However, VA is conducting market research to determine if there are other brands of software available to meet VA s requirements. This notice is issued solely for information and planning purposes it does not constitute a Request for Quote (RFQ)/Invitation for Bid (IFB)/Request for Proposal (RFP) or a promise to issue an RFQ, IFB or RFP in the future. This notice does not commit the VA to contract for any supply or service. Further, the VA is not seeking quotes, bids or proposals at this time and will not accept unsolicited proposals in response to this sources sought notice. The VA will not pay for any information or administrative costs incurred in response to this notice. Submittals will not be returned to the responder. Not responding to this notice does not preclude participation in any future RFQ or IFB or RFP, if any is issued. If a solicitation is released, it will be synopsized on the Governmentwide Point of Entry. It is the responsibility of potential offerors to monitor the Governmentwide Point of Entry for additional information pertaining to this requirement. The anticipated NAICS code is: 541519, Other Computer Related Services with a size standard of 150 employees. VA currently uses Real Time Location System (RTLS) Asset Tracking Handheld Software Application across 69 sites throughout the enterprise, representing a significant portion of VA s operational footprint. RTLS software licenses to support ongoing maintenance, expansion, and standardization efforts at sixty-nine VA medical facilities. These licenses are essential for ensuring that asset tracking and management processes remain consistent and efficient across all sites. Below are the minimum requirements and salient characteristics of the required software. If interested and capable of providing an alternate solution, please provide a capabilities statement detailing the specific software and how it meets the full requirement. Please also provide a pricing estimate. Email Responses by: August 15, 2026 Point of contact is Mr. Juan C. Perez, contract specialist at e-mail address juan.perez5@VA.GOV; phone 512-981-4467. MOBILE TAGGING SOFTWARE SOLUTION Provide a solution that is compatible with Current VA Interprise Asset Management LBI and have an agreement with Current VA Interprise Asset Management that will enable the software to perform all functions identified below: Requirement Description The RTLS Handheld solution shall be accessible via a government issued VA TRM approved iPhone, compatible with iPhone accessibility features, and shall be available for download by authorized user The RTLS Handheld solution shall not allow a duplicate entry of an asset to a given facility and shall provide notification to the user that the asset is already in the system. The RTLS Handheld solution shall allow a tag that has been decommissioned to be associated with a new asset. The RTLS Handheld solution shall allow decommissioning of any asset under any condition. The RTLS Handheld solution shall include permission-based access specifically for reporting features The RTLS Handheld solution shall include permission-based system administration for user management The RTLS Handheld solution shall be compliant with NIST Federal Information Processing Standard (FIPS) and shall be compatible with iOS software The RTLS Handheld solution shall be compatible with Transport protocol: HTTPS The Contractor shall provide a user guide for the RTLS Handheld solution in PDF format that addresses: Installation of software on user device Access instructions Tagging process, instructions, guidelines, and best practices Report generation and access Frequently Asked Questions (derived from Help Desk Queries) Use of Help Desk to answer user questions The RTLS Handheld solution shall be capable of scanning and commissioning CenTrak® active RFID tags in Infor® LBI using built-in phone camera with VA Technical Reference Model (TRM) approved phones The RTLS Handheld solution shall provide a downloadable list for items to be commissioned The RTLS Handheld solution shall be capable of scanning bar codes The RTLS Handheld solution shall be capable of scanning and decommissioning CenTrak® active RFID tags in Infor® LBI using built-in phone camera with VA Technical Reference Model (TRM) approved phones The RTLS Handheld solution shall be compatible with production versions of iOS on the VA Technical Reference Model (TRM) The RTLS Handheld solution shall support Bluetooth-connected FIPS Compliant Hardware The RTLS Handheld solution shall include the following reporting features: Tags commissioned Tags commissioned by user Tags decommissioned Tags decommissioned by user The RTLS Handheld solution shall include the following query features: Ability to view status of tags Prevention of commissioning of assigned tags The RTLS Handheld solution shall provide the capability to transfer data to the RTLS system wirelessly, where available. The RTLS Handheld solution shall provide the capability to read a location off of a barcode. (Barcodes typically affixed at entries to rooms and other areas). The RTLS Handheld solution shall provide the capability to manually enter its current location. For wirelessly enabled handheld scanners, the RTLS Handheld solution shall provide the capability to identify its current location. The RTLS Handheld solution shall give an error when it cannot sync with Infor® LBI The RTLS Handheld solution shall enable other RTLS mobile utility modules to include Battery Management (optional task) Wifi Accuracy Testing (optional task) Ability to work in offline mode (no network connectivity) Automatic timeout after 5 minutes for of users that are not actively utilizing the application The RTLS Handheld solution shall provide data encryption in transit and at rest The RTLS Handheld solution shall allow for the commissioning and/or decommissioning a tag and asset in under 60 seconds. The RTLS Handheld solution must meet 508 compliance requirements on the iPhone Transaction time between the tag up activity and when data is associated in Infor® LBI shall be less than 60 seconds The RTLS Handheld solution shall support at least 5 concurrent users per facility. Facility is defined by a facility that has a unique site ID. The contractor shall provide an acknowlegement within 60 minutes of receipt/notification of a Critical severity incident and take immediate action to ensure reported incident is resolved. Average resolution time shall be no longer than 8 hours. A Critical severity incident is defined as meeting one or more of the following criteria: Complete loss of functionality/system Functionality severely degraded Loss of those features or functionality that may compromise: (i) medical decisions, (ii) delivery of patient care, (iii) disclosure of confidential information The contractor shall provide an acknowledgement within 120 minutes of receipt/notification of a Medium severity incident and ensure a plan of action is put in place that defines the resolution time. Average resolution time shall be no longer than 12 hours. A Medium severity incident is defined as meeting the following criteria: Disruption or a partial loss of the system, but the system is usable The contractor shall provide an acknowledgement within 24 hours of receipt/notification of a Low severity incident and appropriate resources are assigned within 48 hours. Average resolution time shall be no longer than 80hours. A Low severity incident is defined as meeting the following criteria: Customer is experiencing issues that require technical advice or recommendation for the best solution and/or have slight impact on the operating environment The RTLS Handheld solution shall meet or exceed the following reliability standards: Availability 95% Mean Time Between Failures (MTBF) 3 months Mean Time to Repair (MTTR) 3 days, 36 hours Accuracy 95% commission rate The RTLS Handheld shall require no more than 8 hours of maintenance per month. Servicing and maintenance is expected to occur on the weekends during periods of least usage. The RTLS Handheld solution shall be integrated with VA PIV D/SSOi The RTLS Handheld solution shall comply with VA Security Compliance/Mobile Application "White Listing" process and be included on VA application White List. The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0. The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, VA System Security Controls , and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need. The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program. The Contractor shall ensure all Contractor delivered applications and systems support: Automated provisioning and are able to use enterprise provisioning service. Interfacing with VA s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]). Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication. Role Based Access Control. Auditing and reporting capabilities. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896. The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3. The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 USGv6 Profile (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 Guidelines for the Secure Deployment of IPv6 (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration The Contractor shall ensure all devices support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. The Contractor shall ensure all public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, Update to the Trusted Internet Connections (TIC) Initiative (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 Secure External Connections , and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov. The RTLS Handheld solution must have the ability to run reports on the commissioning process The RTLS Handheld solution shall display an alert when there is a loss in connectivity. The RTLS Handheld solution shall operate outside the Medical Telemetry Frequency Range. The RTLS Handheld solution shall provide the capability of synching the inventory data with RTLS. The RTLS Handheld solution shall dynamically monitor itself to determine if all its components are working properly. The contractor shall provide virtual end user training to include Access instructions Commissioning and decommissioning of inventory Software installation and operation Troubleshooting and maintenance Report and query generation INTEGRATION SERVICES: The mobile tagging application is fully integrated with Current VA Interprise Asset Management LBI instances in to include provision of Current VA Interprise Asset Management Tagging Connector licenses for each VISN. Contractor solution shall provide PIV-D/SSOi integration as required. LICENSING: Provide a single license per facility for an unlimited number of users at each facility. The license should allow for a minimum of 5 simultaneous users at each site. USER SUPPORT: Provide help desk to respond to user queries during business hours, 8AM 5PM (EST) Monday to Friday to include: User support (respond to issues and queries.) RTLS integration support Security compliance and continuous monitoring. (Incident response per standards in Table 1.) HELP DESK INCIDENT RESPONSE Table 1: Incident Response Time Limits Severity Description Initial Response Time Average Resolution Time Critical: (Level 1) Business is substantially disrupted A critical incident is defined as meeting one or more of the following criteria: Complete loss of functionality/system Functionality severely degraded Loss of those features or functionality that may compromise: (i) medical decisions, (ii) delivery of patient care, (iii) disclosure of confidential information Acknowledgment within 1 hour of receipt/notification Immediate action is taken to resolve reported incident After hours issues to be acknowledged and resolved next business day 24 hours Medium: (Level 2) Some business disruption, but able to function There is disruption or a partial loss of the system, but the system is usable, and the incident does not meet the above criteria. Acknowledgment of receipt within 2 hours A plan of action is put in place that defines the resolution time After hours issues to be acknowledged and resolved next business day 48 hours Low: (Level 3) Inquiry or long-term request Customer is experiencing issues that require technical advice or recommendation for the best solution and/or have slight impact on the operating environment Acknowledgment within 24 hours of receipt/notification Appropriate resources are assigned within 48 hours 80 hours SCHEDULED RELEASES: Scheduled releases shall be coordinated with and approved by COR and installed to the maximum extent possible on weekends. Contractor shall include the following in scheduled releases: Communicate updates to end users Defect logging and repair New feature additions proposed by contractor The contractor shall comply with the RTLS Change Control Process and obtain approval from the VA RTLS Change Control Board for material changes to the system. ADDITONAL SITE LICENSES (OPTIONAL): Provide a single license per facility for an unlimited number of users at each facility. The license should allow for a minimum of 5 simultaneous users at each site.