36C10B25P0189.docx

This is a Request for Information (RFI) issued by the Department of Veterans Affairs Technology Acquisition Center for Zero Trust Application Realtime Protection (ZARP) services. The response deadline is February 28, 2025, at 12:00 PM ET, with responses to be sent to Michael Berberich and David Long. The opportunity falls under NAICS code 541519 with a size standard of $34M.

The VA seeks a comprehensive application security solution that provides both Web Application Firewall (WAF) and Runtime Applications Self-Protection (RASP) capabilities, integrating with existing Palo Alto Next Generation Firewalls. Key requirements include protection against OWASP vulnerabilities, zero-day attack defense, support for both modern and legacy applications, and enterprise scalability starting with 100 systems and expanding to protect 1,000-1,500 applications within two years. The anticipated contract will be Firm-Fixed-Price with a base year plus four option years. The solution must maintain 99.99% uptime, process 100,000 requests per second, reduce web application attacks by 50% in the first year, and integrate with VA's SIEM, ConMon, and incident response platforms while meeting FISMA, FedRAMP, and FIPS 140-2 requirements.