36C10B25Q0429 0001.docx
DOCX document 17 KB Posted
- Solicitation number
- 36C10B25Q0429
About this file
This document is a Request for Information (RFI) from the Department of Veterans Affairs (VA) Technology Acquisition Center for a Zero Trust Application Realtime Protection (ZARP) solution. The RFI seeks a comprehensive, turnkey cybersecurity solution supporting application and API runtime protection across VA's enterprise environments, with a focus on web applications, APIs, and critical backend services in hybrid cloud settings. The government is specifically interested in Palo Alto's Prisma Cloud Enterprise Edition or equivalent solutions that provide Web Application and API Security (WAAS), Cloud Workload Protection Platform (CWPP), and runtime protection capabilities.
Key procurement details include a proposed firm-fixed-price contract with a base year and four option years, targeting FedRAMP-authorized solutions that can support on-premises, cloud, and hybrid environments. The RFI requires vendors to submit a 10-page response by July 16, 2025, at 12:00 PM ET, detailing their solution's technical capabilities, integration potential with Splunk, IAM systems, and CI/CD pipelines, and ability to meet specific requirements like Runtime Application Self Protection (RASP). The solution must demonstrate a true-positive detection rate of at least 98% and be capable of protecting cloud-native, containerized, and serverless applications across VA's infrastructure.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 36C10B25Q0429 0002.docx | DOCX document | |
| 36C10B25Q0429.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Modification to a Previous Notice Modification to a Previous Notice
| SUBJECT* |
| Zero Trust Application Realtime Protection (ZARP) (VA-25-00093376) |
GENERAL INFORMATION
| CONTRACTING OFFICE’S ZIP CODE* |
| 07724 |
| SOLICITATION NUMBER* |
| 36C10B25Q0429 |
BASE NOTICE TYPE
| RESPONSE DATE/TIME/ZONE |
| 07-16-2025 12pm EASTERN TIME, NEW YORK, USA |
| ARCHIVE |
| 30 DAYS AFTER THE RESPONSE DATE |
| RECOVERY ACT FUNDS |
| N |
SET-ASIDE
| PRODUCT SERVICE CODE* |
| DJ01 |
| NAICS CODE* |
| 541519 |
| CONTRACTING OFFICE ADDRESS |
| Department of Veterans Affairs |
Technology Acquisition Center
23 Christopher Way Eatontown NJ 07724
POINT OF CONTACT*
Contract Specialist Michael Berberich michael.berberich@va.gov
PLACE OF PERFORMANCE
ADDRESS
POSTAL CODE
COUNTRY
ADDITIONAL INFORMATION
AGENCY’S URL
URL DESCRIPTION
AGENCY CONTACT’S EMAIL ADDRESS
EMAIL DESCRIPTION
DESCRIPTION
1) QUESTION: Can you list the number of applications and break out how they are hosted? Interested in the number of container nodes, VMs, Serverless functions, etc.
ANSWER: VA does not publish its application inventory at the market-research (RFI) stage. The exact number of applications—and their hosting breakdown across on-premises data centers, VA Enterprise Cloud (AWS GovCloud US & Azure Government), and other environments—will be provided to the selected vendor during post-award discovery and onboarding.
2) QUESTION: Could the Government clarify whether Elastic SIEM integration is a requirement or if Splunk-only integration would be sufficient?
ANSWER: Splunk-only Integration is sufficient
3) QUESTION: Are there specific Splunk configurations or deployment models (cloud, on-premises, or hybrid) that the solution must support?
ANSWER: The ZARP solution must cleanly support on-prem, cloud, and hybrid Splunk ingestion.
4) QUESTION: Do you require SPUNK pricing in the ROM?
ANSWER: No
5) QUESTION: SOAR Platforms (Swimlane): Are there particular Swimlane integrations or workflows that the solution should accommodate to align with VA’s current SOAR environment?
ANSWER: At this stage we are not releasing VA-specific Swimlane playbooks or connector details.
6) QUESTION: Which IAM systems are deployed within VA (e.g., Microsoft Azure AD, Okta, Ping Identity), and are there specific protocols (SAML, OAuth, OpenID Connect) required for integration?
ANSWER: The VA uses multiple IAM services in a hybrid on-prem / cloud environment. More details will be furnished to the selected vendor during post-award discovery and onboarding.
7) QUESTION: Given the use of Tenable for vulnerability management, are there specific integration requirements or use cases VA expects? Additionally, could VA identify CI/CD platforms in use (e.g., Jenkins, GitLab, Azure DevOps) that the solution should integrate with?
ANSWER: VA uses several CI/CD pipelines. Pipeline details are sensitive and will be shared only with the awardee under post-award security procedures.
8) QUESTION: To provide a meaningful Rough Order of Magnitude (ROM) for the ZARP RFI, could the government provide approximate counts of workloads (VMs, containers, serverless functions) and anticipated data ingestion volumes for SIEM/SOAR integration?
ANSWER: The requested information is not available
9) QUESTION: Please clarify which Prisma Cloud modules (e.g., WAAS, CWPP, CSPM) VA expects vendors to include.
ANSWER: WAAS & CWPP
10) QUESTION: For scoping the number of VA workloads, how many on-premise container hosts will the solution need to support?
ANSWER: The requested information is not available
11) QUESTION: For scoping the number of VA workloads, how many K8 worker nodes will the solution need to support?
ANSWER: The requested information is not available
12) QUESTION: For scoping the number of VA workloads, how many serverless containers (AWS-Fargate / Azure ACI) will the solution need to support?
ANSWER: The requested information is not available
13) QUESTION: Can the VA confirm the solution must be capable of Runtime Application Self Protection (RASP)?
ANSWER: Yes, the solutions must be capable of Runtime Application Self Protection
14) QUESTION: Will the proposed zero trust solution require traffic visibility and enforcement aspects of ZTS – Zero Trust Segmentation (or micro-segmentation), or will it be primarily based on North-South subnet-based enforcement?
ANSWER: This RFI covers runtime-application and workload protection (ZARP). Network-level Zero Trust Segmentation (micro-segmentation) is handled by separate VA controls. The solution must inspect and enforce at Layer 7 for both North-South traffic (ingress/egress) and East-West traffic that remains within a subnet or host.
Detailed integration points with VA’s ZTS environment will be defined during post-award discovery.
15) QUESTION: What is the scope of number of locations, workloads, applications as part of this solicitation or any other details you can provide that would be helpful for vendors?
ANSWER: This information is not available
16) QUESTION: Is the request for this new solution replacing existing technology and what is the existing solution today?
ANSWER: There is no existing solution
17) QUESTION: Is the VA using any segmentation solutions today within this environment and what is the technology being used?
ANSWER: The specific vendors, products, and policy schemas are considered sensitive architecture details and will be disclosed only to the awardee under post-award security procedures.
18) QUESTION: What GWACs is the VA currently considering for this procurement? Is GSA VETS 2 being considered?
ANSWER: To be determined. The contract vehicle will be determined based on the responses received from the RFI. Please provide any existing contract vehicles per RFI Submittal Information paragraph 3(g).
| *= Required Field |
| Modification to a Previous Notice |
Modification to a Previous Notice
File details come from the government source that posted it. Updated .