DA01--FY 27 NYH ISCV DATA RECOVERY SERVICES - 1 YEAR ONLY
Sources Sought from the Department of Veterans Affairs, for work in New York. Due Oct 23, 2026, 10:00 AM (UTC-4), 5 days left.
| Solicitation number | 36C24227Q0060 |
|---|---|
| Agency | Department of Veterans Affairs |
| Office | 242-Network Contract Office 02 (36C242) |
| Notice type | Sources Sought |
| Set-aside | None |
| Trade (NAICS) | Computer Systems Design Services (541512) |
| Product or service code | DA01 |
| Place of performance | New York |
| Posted | Oct 16, 2026 |
| Response deadline | Oct 23, 2026, 10:00 AM (UTC-4) (5 days left) |
Official notice and attachments
Description
Sources Sought Notice Sources Sought Notice Page 5 of 5 *= Required Field Sources Sought Notice Page 1 of 5 This notice is for the purpose of identifying parties having an interest in and the resources to support this requirement for: Philips ISCV Radiographic DICOM Data Recovery Services needed for the VA New York Harbor Healthcare System, Manhattan Campus located at 423 E 23rd Street New York, NY 10010.
Background VA New York Harbor Healthcare System has two critical NetGear ReadyNAS 3220 storage systems used to house all Philips ISCV Radiographic DICOM studies from 2007 2020. The primary NAS, XLBACKUP1, contained the active historical repository of patient studies, while XLARCHIVE served as an exact mirror backup. Both systems have experienced hardware failure resulting in complete RAID volume loss.
What happened: Both NETGEAR ReadyNAS 3220 systems failed, resulting in loss of both RAID6 volumes. Hardware details: 2× NETGEAR ReadyNAS 3220 NAS systems 12 disks per NAS, 12 disks per volume Disk type: SATA 2.0 TB, model WD20000FYYZ 01UL1B1 RAID configuration: RAID 6 Objectives & Scope The Manhattan VA NYHHS requires professional forensic data recovery services to restore patient Radiographic DICOM studies (Year 2007 Year 2020) lost due to the RAID volume failures described above.
The vendor's work is divided into custody/handling, recovery, and secure destruction obligations as follows: Custody, Imaging & Recovery Pick up or receive labeled drives from VA. Every individual who handles or works on the drives must complete and sign a VA Chain of Custody form. Forensically image all original NAS disks (no intrusive work on originals, unless physical repair of a disk is necessary to enable imaging).
All accessible DICOM studies (Year 2007 Year 2020) are restored. Metadata and directory structure are intact and properly associated with studies. Delivery & Data Destruction Provide recovered datasets on externally accessible media.
Ensure recovered datasets can be successfully migrated into AGFA Radiology PACS. Upon written confirmation from the VA to be provided within 14 business days of delivery of the recovered data and files that the recovered data and files have been reviewed and accepted, destroy all VA data, including but not limited to any cloned disk images, extracted information, metadata, temporary processing files, logs, or partial RAID reconstructions created during the recovery process.
Provide the VA with a Certificate of Destruction, signed by an authorized compliance officer, confirming that all VA data from internal systems, temporary storage, cloned disk images, and any other media has been securely purged and irreversibly destroyed. Item/Quantity Description Item Description Qty 1 Return of all 24 original disks 24 disks 2 Recovery of all patient studies (Year 2007 Year 2020) on portable media 1 Period of Performance The estimated date of period of performance will begin around December 1st, 2026 and end on January 31st, 2027.
The procurement will be conducted under FAR Part 12 Part 12 - Acquisition of Commercial Products and Commercial Services. The NAICS code is 541512, and the size standard is $34 million. There is no solicitation at this time.
This request for capability information does not constitute a request for proposals; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred. Responses to this announcement will be used to determine the market for this service and whether sufficient interest exists to set the procurement aside.
Responses to this notice shall be submitted via e-mail to [email protected] by October 23rd, 2026. Telephone replies will not be honored. If your organization has the interest and capability to perform these services, please provide the following information:
- Organization name, address, email address, website address, telephone number, and size and type of ownership for the organization; and
- A tailored capability statement addressing the particulars of this effort, with appropriate documentation supporting claims of capability.
- Responses shall confirm a clean-room facility: The contractor must have and maintain a current clean-room Class-10 (ISO
- certification for all physical drive disassembly, head-swap, or platter-level recovery work.
Responses shall confirm Audit/compliance standards: The contractor must abide by SSAE 18 Type II SOC 1, Type I SOC 2, and SOC 3 audit requirements, and must provide current audit reports or attestation letters demonstrating compliance. Proof of Personnel certification (minimum): Data recovery specialists assigned to this engagement must hold a current Certified Data Recovery Professional (CDRP) credential issued by the Information Assurance Certification Review Board (IACRB).
CDRP certification focuses on the essential skills needed for data recovery and will be treated as the baseline personnel qualification. 4) Interested small businesses shall detail their ability to comply with Limitations on Subcontracting. Interested SDVOSB/VOSBs shall also, indicate their ability to comply with VAAR 852.219-75 Notice of Limitations on Subcontracting and shall sign the certification below.
852.219-75 VA Notice of Limitations on Subcontracting Certificate of Compliance for Services and Construction. As prescribed in 819.7011(b), insert the following clause: VA Notice of Limitations on Subcontracting Certificate of Compliance for Services and Construction (NOV 2022) (a) Pursuant to 38 U.S.C. 8127(k)(2), the offeror certifies that (1) If awarded a contract (see FAR 2.101 definition), it will comply with the limitations on subcontracting requirement as provided in the solicitation and the resultant contract, as follows: [Contracting Officer check the appropriate box below based on the predominant NAICS code assigned to the instant acquisition as set forth in FAR 19.102.] (i) Services.
In the case of a co
The description continues in the official notice.
About the buyer
The Department of Veterans Affairs awarded $84.2 billion in contracts in the last 12 months; its biggest suppliers were Optum Public Sector Solutions, Inc., Mckesson Corporation and Triwest Healthcare Alliance Corp. See what VA is buying now.