Description

Sources Sought Notice

Sources Sought Notice

Page 5 of 5
*= Required Field
Sources Sought Notice

Page 1 of 5

This notice is for the purpose of identifying parties having an interest in and the resources to support this requirement for: Philips ISCV Radiographic DICOM Data Recovery Services needed for the VA New York Harbor Healthcare System, Manhattan Campus located at 423 E 23rd Street New York, NY 10010.
Background
VA New York Harbor Healthcare System has two critical NetGear ReadyNAS 3220 storage systems used to house all Philips ISCV Radiographic DICOM studies from 2007 2020. The primary NAS, XLBACKUP1, contained the active historical repository of patient studies, while XLARCHIVE served as an exact mirror backup. Both systems have experienced hardware failure resulting in complete RAID volume loss.
What happened: Both NETGEAR ReadyNAS 3220 systems failed, resulting in loss of both RAID6 volumes.
Hardware details:
2× NETGEAR ReadyNAS 3220 NAS systems
12 disks per NAS, 12 disks per volume
Disk type: SATA 2.0 TB, model WD20000FYYZ 01UL1B1
RAID configuration: RAID 6
Objectives & Scope
The Manhattan VA NYHHS requires professional forensic data recovery services to restore patient Radiographic DICOM studies (Year 2007 Year 2020) lost due to the RAID volume failures described above. The vendor’s work is divided into custody/handling, recovery, and secure destruction obligations as follows:
Custody, Imaging & Recovery
Pick up or receive labeled drives from VA.
Every individual who handles or works on the drives must complete and sign a VA Chain of Custody form.
Forensically image all original NAS disks (no intrusive work on originals, unless physical repair of a disk is necessary to enable imaging).
All accessible DICOM studies (Year 2007 Year 2020) are restored.
Metadata and directory structure are intact and properly associated with studies.
Delivery & Data Destruction
Provide recovered datasets on externally accessible media. Ensure recovered datasets can be successfully migrated into AGFA Radiology PACS.
Upon written confirmation from the VA to be provided within 14 business days of delivery of the recovered data and files that the recovered data and files have been reviewed and accepted, destroy all VA data, including but not limited to any cloned disk images, extracted information, metadata, temporary processing files, logs, or partial RAID reconstructions created during the recovery process.
Provide the VA with a Certificate of Destruction, signed by an authorized compliance officer, confirming that all VA data from internal systems, temporary storage, cloned disk images, and any other media has been securely purged and irreversibly destroyed.
Item/Quantity Description
Item Description Qty
1 Return of all 24 original disks 24 disks
2 Recovery of all patient studies (Year 2007 Year 2020) on portable media 1
Period of Performance
The estimated date of period of performance will begin around December 1st, 2026 and end on January 31st, 2027.
The procurement will be conducted under FAR Part 12 Part 12 – Acquisition of Commercial Products and Commercial Services.
The NAICS code is 541512, and the size standard is $34 million.
There is no solicitation at this time. This request for capability information does not constitute a request for proposals; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred. Responses to this announcement will be used to determine the market for this service and whether sufficient interest exists to set the procurement aside.
Responses to this notice shall be submitted via e-mail to tevia.mastykarz@va.gov by October 23rd, 2026. Telephone replies will not be honored.
If your organization has the interest and capability to perform these services, please provide the following information:
1) Organization name, address, email address, website address, telephone number, and size and type of ownership for the organization; and
2) A tailored capability statement addressing the particulars of this effort, with appropriate documentation supporting claims of capability.
3) Responses shall confirm a clean-room facility: The contractor must have and maintain a current clean-room Class-10 (ISO 4) certification for all physical drive disassembly, head-swap, or platter-level recovery work.
Responses shall confirm Audit/compliance standards: The contractor must abide by SSAE 18 Type II SOC 1, Type I SOC 2, and SOC 3 audit requirements, and must provide current audit reports or attestation letters demonstrating compliance.
Proof of Personnel certification (minimum): Data recovery specialists assigned to this engagement must hold a current Certified Data Recovery Professional (CDRP) credential issued by the Information Assurance Certification Review Board (IACRB). CDRP certification focuses on the essential skills needed for data recovery and will be treated as the baseline personnel qualification.
4) Interested small businesses shall detail their ability to comply with Limitations on Subcontracting. Interested SDVOSB/VOSBs shall also, indicate their ability to comply with VAAR 852.219-75 Notice of Limitations on Subcontracting and shall sign the certification below.

852.219-75 VA Notice of Limitations on Subcontracting Certificate of Compliance for Services and Construction.
As prescribed in 819.7011(b), insert the following clause:

VA Notice of Limitations on Subcontracting Certificate of Compliance for Services and Construction (NOV 2022)

(a) Pursuant to 38 U.S.C. 8127(k)(2), the offeror certifies that

(1) If awarded a contract (see FAR 2.101 definition), it will comply with the limitations on subcontracting requirement as provided in the solicitation and the resultant contract, as follows: [Contracting Officer check the appropriate box below based on the predominant NAICS code assigned to the instant acquisition as set forth in FAR 19.102.]

(i) Services. In the case of a contract for services (except construction), the contractor will not pay more than 50% of the amount paid by the government to it to firms that are not VIP-listed SDVOSBs as set forth in 852.219-73 or VOSBs as set forth in 852.219-74. Any work that a similarly situated VIP-listed subcontractor further subcontracts will count towards the 50% subcontract amount that cannot be exceeded. Other direct costs may be excluded to the extent they are not the principal purpose of the acquisition and small business concerns do not provide the service as set forth in 13 CFR 125.6.

(ii) General construction. In the case of a contract for general construction, the contractor will not pay more than 85% of the amount paid by the government to it to firms that are not VIP-listed SDVOSBs as set forth in 852.219-73or VOSBs as set forth in 852.219-74. Any work that a similarly situated VIP-listed subcontractor further subcontracts will count towards the 85% subcontract amount that cannot be exceeded. Cost of materials are excluded and not considered to be subcontracted.

(iii) Special trade construction contractors. In the case of a contract for special trade contractors, the contractor will not pay more than 75% of the amount paid by the government to it to firms that are not VIP-listed SDVOSBs as set forth in 852.219-73 or VOSBs as set forth in 852.219-74. Any work that a similarly situated subcontractor further subcontracts will count towards the 75% subcontract amount that cannot be exceeded. Cost of materials are excluded and not considered to be subcontracted.

(2) The offeror acknowledges that this certification concerns a matter within the jurisdiction of an Agency of the United States. The offeror further acknowledges that this certification is subject to Title 18, United States Code, Section 1001, and, as such, a false, fictitious, or fraudulent certification may render the offeror subject to criminal, civil, or administrative penalties, including prosecution.

(3) If VA determines that an SDVOSB/VOSB awarded a contract pursuant to 38 U.S.C. 8127 did not act in good faith, such SDVOSB/VOSB shall be subject to any or all of the following:

(i) Referral to the VA Suspension and Debarment Committee;

(ii) A fine under section 16(g)(1) of the Small Business Act (15 U.S.C. 645(g)(1)); and

(iii) Prosecution for violating section 1001 of title 18.

(b) The offeror represents and understands that by submission of its offer and award of a contract it may be required to provide copies of documents or records to VA that VA may review to determine whether the offeror complied with the limitations on subcontracting requirement specified in the contract. Contracting officers may, at their discretion, require the contractor to demonstrate its compliance with the limitations on subcontracting at any time during performance and upon completion of a contract if the information regarding such compliance is not already available to the contracting officer. Evidence of compliance includes, but is not limited to, invoices, copies of subcontracts, or a list of the value of tasks performed.

(c) The offeror further agrees to cooperate fully and make available any documents or records as may be required to enable VA to determine compliance with the limitations on subcontracting requirement. The offeror understands that failure to provide documents as requested by VA may result in remedial action as the Government deems appropriate.

(d) Offeror completed certification/fill-in required. The formal certification must be completed, signed and returned with the offeror’s bid, quotation, or proposal. The Government will not consider offers for award from offerors that do not provide the certification, and all such responses will be deemed ineligible for evaluation and award.

Certification

I hereby certify that if awarded the contract, [insert name of offeror] will comply with the limitations on subcontracting specified in this clause and in the resultant contract. I further certify that I am authorized to execute this certification on behalf of [insert name of offeror].

Printed Name of Signee:

Printed Title of Signee:

Signature:

Date:

Company Name and Address: