RFI-Zero Trust Application Questions and Answers.docx

RFI-Zero Trust Application Questions and Answers

1. What is the proposed timeframe of the initial installation?

Government Response: 30 calendar days from contract award

2. Will this happen prior to the end of the government Fiscal Year?

Government Response: Yes

3. Can you define which operating systems would be required to support the legacy applications?

Government Response: Both Windows and Linux

4. How many workloads would be part of the 100 applications for initial deployment? Containers? VMs? Serverless functions?

Government Response: Unknown, this would depend on which applications were selected as the initial pilot deployment.

5. How many workloads would be part of the 1000-1500 applications for enterprise deployment? Containers? VMs? Serverless functions?

Government Response: Same as above unknown would depend on which applications are selected for RASP protection.

6. Can you please clarify the past performance requirements and confirm if they apply to the overall 10-page limit?

Government Response: Past performance submissions do not count toward the 10-page limit.

Can you please confirm if businesses other than VOSB/SDVOSB are eligible for award of prime contract for this opportunity? Is there a waiver to limitations of subcontracting when using a COTS manufacturer?

Government Response: The results of the responses to this RFI will determine what the set-aside will be on the resultant solicitation. There are no waivers to the limitations on subcontracting when using a COTS manufacturer.

7. Please confirm this requirement. The introductory paragraph of the RFI says no quotes. If this requirement is still in scope, more information about the proof of concept is needed. Please provide the following workload count information:

a) Number of virtual machines:

b) Number of container hosts:

c) Number of serverless functions:

d) Number of serverless containers:

e) Data workload, non-OS disk workload, and registry container image workload ratios:

f) Number of buckets:

g) Number of PaaS databases:

h) Number of data warehouses:

i) Number of non-OS disks:

j) Number of container images:

Government Response: Answers to the above questions are unknown currently.

8. What are the hardware/software requirements for the legacy applications that we must be compatible with?

Government Response: This is for a new solution. Vendors are expected to propose a solution with the require people, processes, and technologies.

9. Please provide which threat intelligence products/feeds the solution must integrate with and the protocols that must be supported.

Government Response: To include but not limited to Splunk.

10. Does the solution need to provide the centralized dashboard, or can the solution provide logs and metrics to a SIEM that can be used to monitor?

Government Response: Both a dashboard as well as logs and metrics to the SIEM solution is expected.

11. Please provide more information about the features of a RASP solution that is being requested. Would Application Detection and Response (ADR) functionality or Cloud Workload Protection address this need?

Government Response: Required features: Runtime threat detection and prevention (e.g., SQL injection, XSS, and command injection attacks, 0-day attacks).

Context-aware security that monitors the application’s execution flow and user interactions.

Self-protection mechanisms that respond to threats in real time, such as terminating malicious sessions or blocking requests.

The requested solution requires real-time, in-application threat prevention (e.g., blocking attacks as they occur within an application), as such RASP remains the best solution.

12. For the users accessing the 1,000+ web applications, are these users strictly un-authenticated or authenticated users? Or a combination of both?

Government Response: A combination of both

13. Is this effort ONLY focused on securing incoming traffic? Or, will this effort also be securing outbound traffic (originating from the servers)?

Government Response: Both inbound and outbound

14. Out of the 1,000+ “web” applications mentioned, how many of them will be exclusively utilizing HTTP traffic?

Government Response: Since RASP is designed to protect Web based applications all will be web HTTPS traffic.

15. What is the hosting platform for the web servers? Are they container based or VM based?

Government Response: That would depend on which applications are selected for the protection, but we can assume a combination.

16. Will there be a requirement to secure traffic between front end Web applications to backend systems not hosted in AWS?

Government Response: Possibly depending on which applications are selected.

17. By what date do respondents need to be FedRamp compliant by?

Government Response: By award date

18. When do you intend to start the evaluative engagement as well as project start?

Government Response: Within 10 business days after award

19. We are uncertain about what was expected to be submitted by noon EST today. Was the intention to have questions submitted today and completed responses in 4 business days or were both expected to be submitted by today at noon EST?

Government Response: 6 business days for questions from vendors and an additional 4 business days to submit responses based on answers to the questions.

20. What do you need from us today vs. what is needed or due in 4 days?

Government Response: Vendors are to initially provide questions, then vendors are to provide information about a solution that meets the government’s needs as specified in the posting.

21. Is the VA considering FedRamp approved SaaS-based application security solutions to offload infrastructure management?

Government Response: No

22. What solution does VA leverage today for SIEM and/or log aggregation?

Government Response: to include but not limited to Splunk.

23. Does the VA plan to have the integrator build the dashboard using a newly implemented solution/tool, or will the dashboard need to be built in existing VA SIEM and managed by CSOC?

Government Response: Not sure.

24. Question A: Is multi-tenancy a requirement of the WAF solution to ensure VA sub-organizations can manage customized policy?

Government Response: Yes

25. Question B: Additionally, is hierarchical multi-tenancy required (i.e. policy from parent tenants gets flowed down to child tenants)?

Government Response: Also, Yes.

26. Would the Government provide a list of the programming languages and frameworks that need to be supported?

Government Response:

To include but not limited to:

Java Spring Boot Jakarta EE / Java EE Struts Play Framework Grails

.NET / .NET Core

ASP.NET MVC

ASP.NET Core Blazor Node.js

Express.js Nest.js Koa.js Python

Django Flask FastAPI Ruby

Ruby on Rails Sinatra

PHP

Laravel Symfony CodeIgniter Zend Framework Go (Golang)

Gin Echo Fiber C / C++

Frameworks REST APIs (regardless of backend language) GraphQL APIs WebSockets & Real-Time APIs

27. Would the Government provide a list of application runtime environments and associated Continuous Deployment (CD) and other similar tools that need to be supported?

Government Response: To include but not limited to Java (JVM-based apps) .NET Core / .NET

28. An Objective and Key Result (OKR) is provided here to measure WAF outcomes. What is the OKR that will be used to measure RASP outcomes (as one is not specified in Item 1 "Runtime Threat Detection and Prevention")?

Government Response: TBD

29. An OKR is provided here to measure WAF outcomes. What are the OKRs for dashboard and integration functions?

Government Response: TBD

30. Please provide additional details on the overall scope and anticipated duration of the "professional services” support that will be required under this solicitation.

Government Response: Vendors are requested to provide a solution with an appropriate combination of people, processes, and technologies through the solutions lifecycle.

31. Can you please share more details around your vision and specific goals/objectives for the 6-month long proof-of-concept?

Government Response: TBD

32. Can you please identify the specific VA security tools that will be subject to custom API integration with the proposed platform?

Government Response: Not currently.

33. Due to the complexity of this scope and the need to review the responses to the questions, will more than 4 Business days to respond be considered?

Government Response: No

34. Which agency priority this RFI aligns with?

Government Response: Zero Trust

35. For data sharing between security tools (NGFW, WAF, RASP), which specific tools and log formats need to be supported?

Government Response: Syslog, JSON, CEF, LEEF, LTSV (for structured logging).

36. The RFI mentions integration with SIEM, ConMon, and Incident Response platforms (like Splunk, ServiceNow). Are there any specific integration requirements or APIs we should follow?

37. The RFI states that the solution must follow the latest NIST security standards. Should we focus only on current requirements, or also explain how we’ll stay compliant with future updates?

Government Response: The solution is expected to adhere to the latest NIST security standard and align with key frameworks on an ongoing basis.

38. OWASP Vulnerabilities & Runtime Protection - Does VA expect the solution to remediate vulnerabilities, or just detect and block exploits?

Government Response: VA would ultimately like to have the solution remediate vulnerabilities however successful detection and blocking of exploits would be the initial expectation for the solution with a few false positives as possible.

39. RBAC policies - Should the same apply across NGFW, WAF, and RASP, or can each system have independent access control?

Government Response: At this stage, we recognize that different teams will be responsible for managing NGFW, WAF, and RASP, but we have not yet determined whether a unified or independent RBAC model will be most effective. Given that distinct teams will oversee different parts of the solution, it is likely that some level of segmentation in access control will be necessary. However, we also see value in maintaining a level of consistency where practical—such as aligning RBAC policies with common security principles, enforcing least privilege access, and ensuring auditability across all systems.

40. Does VA have specific protocols (e.g., SAML, OAuth, OpenID Connect) that must be followed?

Government Response: Yes, all the above.

41. Should the Appendix A be included in the 10-page submission?

Government Response: No

42. Could you provide more detail on how the proof-of-concept (POC) will be executed?

Government Response: TBD

43. Is the requirement that the solution be on-perm or a cloud-based solution?

Government Response: on-perm, hybrid and cloud-based considered.

44. Could you provide more detail about the requirement for synchronized policies between NGFW, WAF and RASP?

Government Response: The requirement for synchronized policies between NGFW, WAF, and RASP ensures a consistent and effective security posture across network, web, and application layers. Key areas of synchronization include threat Intelligence & IP Blocking: Sharing threat data to block malicious sources across all security layers.

Access Control & Authentication: Ensuring complementary policies for user access, session management, and geofencing Web & API Security: Aligning WAF filtering rules with RASP runtime protections against injection attacks, exploits, and API abuse.

Incident Response & Logging: Correlating alerts across NGFW, WAF, and RASP to detect and mitigate threats faster.

Rate Limiting & Traffic Filtering: Ensuring coordinated defenses against brute-force, scraping, and DoS attacks. To achieve synchronization, policies should be centrally managed through threat intelligence sharing, SIEM/SOAR integration, Security Policy as Code, and API-driven security orchestration.

45. Please provide total traffic volume for the 100-application pilot, 1,000 initial applications and eventual 1,500+ applications.

46. What specific hardware and software environment are you currently using for your web applications?

47. Are you planning to deploy the solution on-premises, in the cloud, or in a hybrid setup?

Government Response: on-perm, hybrid and cloud based considered.

48. Do you have any specific cloud service providers (e.g., AWS, Azure) that the solution must integrate with?

Government Response: No

49. What are your preferred licensing models (annual, perpetual, etc.)? Are you open to different types based on the value provided?

Government Response: No preference.

50. What is your expected scale in terms of deployment (number of users, web apps, etc.)?

51. Can you outline any specific maintenance and renewal requirements you have for the solution?

52. How do you envision the integration of our solution with your current Palo Alto NGFW setup?

Government Response: At this stage, we do not have full visibility into how the integration with our current Palo Alto NGFW setup would be structured. However, we recognize that integration with existing security infrastructure is a key factor for effective deployment.

53. Are there specific use cases or requirements we should be aware of for a seamless integration?

Government Response: Unknown

54. Are there any specific customization needs, or special features required to adapt the solution to your environment?

55. Do you have any existing monitoring systems or tools (like SIEM or Service Desk) that the solution must interface with? If so, which ones?

Government Response TBD

56. What specific compliance standards (FedRAMP, FISMA, FIPS, NIST) are mandatory for your organization?

Government Response: The solution must be fully compliant.

57. How critical is it for your solution to have runtime defense against zero-day attacks and OWASP vulnerability protection? Can you prioritize these features?

Government Response: Both runtime defense against zero-day attacks and OWASP vulnerability protection are critical features, but their priority depends on the overall risk assessment and security objectives. At this stage, we recognize the importance of both capabilities but would need to assess how they align with our specific threat landscape and operational requirements. We are open to further discussions to determine how best to balance these priorities based on our security architecture and risk profile.

58. What are your expectations for performance, particularly regarding minimal impact on application response times during high-load scenarios?

59. How many web applications do you need to protect? Do you have plans to scale beyond 1,000 applications in the near future?

Government Response: 1000 scalable up to 1500

60. What metrics and benchmarks are important to you for tracking the solution’s effectiveness over time?

61. What level of training and support do you expect for your full-time employees to ensure successful implementation and operation of the solution?

Government Response: Employees should be able to independently operate the solution.

62. Would you require professional services for installation, customization, or ongoing monitoring and support? Yes. The solution must include an effective mix of people, processes and technologies.

Government Response: Yes, the government expects the vendor to provide ongoing support, maintenance, updates, and performance monitoring after the solution is deployed include:

· Ongoing Support: We expect continuous technical support to address any issues or questions that arise, with a clear escalation path and defined response times to ensure minimal disruption to our operations.

· Maintenance: Regular maintenance activities are essential to keep the solution operational and efficient. This includes routine checks, preventive measures, and any necessary repairs.

· Updates: Timely updates to the software are crucial to address security vulnerabilities, improve performance, and add new features. We expect both minor patches and major version upgrades to be provided as part of the ongoing service.

· Performance Monitoring: Continuous monitoring of the solution's performance is necessary to ensure it meets our required standards. This includes real-time alerts and detailed reporting on system health and security events.

Furthermore, the solution should be managed by the vendor in its entirety. This means the vendor will be responsible for all aspects of the solution, including deployment, configuration, ongoing management, and support.

63. Are there specific requirements for virtual labs or training materials that you would need?

Government Response: Not currently

64. What specific goals or criteria would you like to achieve during the POC phase?

Government Response: The POC phase should demonstrate the full effectiveness of the solution; otherwise, TBD.

65. What are the key performance indicators (KPIs) or success metrics you’ll use to evaluate the POC?

66. What are your expectations regarding ongoing support, maintenance, updates, and performance monitoring after the solution is deployed?

Government Response: Vendors are requested to provide information about a solution with the appropriate mixture of people, processes, and technologies.

67. Whether vendors should propose their own phased deployment schedule for scaling from 100 to 1,500 applications?

Government Response: Yes

68. If the VA has preferred cloud environments (AWS GovCloud, Azure Government, etc.) for hosting?

Government Response: Yes

69. Whether vendors should prioritize performance (<10ms response time) or full encryption compliance (FIPS 140-2, FedRAMP, etc.) if trade-offs are required?

Government Response: Depends on circumstances.

70. Can the VA provide additional details regarding the types of applications (e.g., web-based, legacy software, custom-built applications) and their hosting environment(s) that are within scope?

71. Are the 1,000 - 1500 applications in scope only accessible within the US or do they permit OCONUS access?

Government Response: access OCONUS is permitted.

72. How many Palo Alto NGFW's exist within the environment today and are they sized to support the requirements for Traffic Inspection?

Government Response: Unknown currently.

73. Are the existing Palo Alto NGFW's hardware-based, virtual, or both?

Government Response: At this stage, we do not have complete visibility into whether the existing Palo Alto NGFW deployment consists of hardware-based, virtual, or a combination of both.

74. What types of data repositories are in place to support Data Masking and what types of files will require data masking?

Government Response: Not known at this time.

75. Does VA require inline deployment (e.g., proxy-based WAF) or out-of-band protection (e.g., API security, SIEM-integrated monitoring)?

Government Response: Not known at this time.

76. What security controls are currently in place for APIs (e.g., API gateways, authentication, rate limiting)?

Government Response: Unknown.

77. What is the acceptable network and application latency impact for the proposed security solution (e.g., WAF processing time, NGFW inspection delays, TLS decryption overhead)?

78. Will the solution need to support a multi-cloud strategy (AWS, Azure, GCP) or integrate with an on-premises data center?

Government Response: The government is open to considering all deployments.

79. Are proposed SaaS solutions required to be FedRAMP Moderate or FedRAMP High?

Government Response: FedRAMP Moderate

80. Is the government hosting 1:1 sessions with vendors? If so, could you please let us know the best way to get in touch with the Program?

Government Response: No, the government is not hosting 1:1 sessions with vendors.

81. Please clarify the scope, scale, and location of the proof of concept. Is this a demonstration project at the contractor's facilities or is it the VA's intent to deploy the solution using an enterprise license into the VA's environment?

Government Response: Proof of Concert must be within VA’s Environment.

82. Does the VA have a test environment that we would be able to connect with to demonstrate the capability as part of the proof of concept or are we expected to create a representative demonstration environment?

83. The instructions on SAM indicate that offerors are required to provide a response to each line in the list of Appendix A. However, no Appendix A exists in the document attached to SAM. Can you please provide the Appendix so we can complete our response?

Government Response: Appendix A starts on page 6 of the SAM attachment. Please ensure you are viewing the correct RFI located at https://sam.gov/opp/24d81b6563c9481cb87b123117a8ab49/view

84. The requirement specifies that the solution must integrate with existing VA security including Palo Alto NGFWs. The term integration is broad. Does having an open API satisfy the requirement? If not, is it possible to provide more details on VA’s expected goals for the integrations?

Government Response: In this context integration means that the RASP solution actively works with the Palo Alto NGFW, rather than simply having the ability to integrate via an open API. This implies a functional relationship where the two solutions exchange security intelligence, enforce coordinated policies, or automate response actions rather than just offering theoretical compatibility.

85. Scaling is affected by both the quantity of systems and the quantity of requests being made of those systems. Please provide more details on the quantity of service requests made to the systems to be protected.

86. These two bullets look to be asking for the same thing, but also prompt the question of whether cloud-native SaaS solutions permissible?

Government Response: All deployments, including cloud-native SaaS solutions will be considered.

87. What is meant by “Adapter” requirements?

Government Response: The term “Adapter” requirements refer to the need for middleware, connectors, or integration components that enable a system to interact with other technologies.

88. There are only two options: 1) Fully Compliant; and 2) Not Compliant. Is there any provision for being partially compliant? If so, there is no way to indicate that. Also, if we check “Not Compliant” for any requirement, does that automatically eliminate the technology from consideration? If not, having a partially compliant option would make sense.

Government Response: The solution must be fully compliant.

89. Do we need to respond to these bullets in our RFI response, or do they pertain to the PoC demonstration?

Government Response: Respond directly to the RFI

90. In the Key Challenges section, the quantity of initial systems is listed as 100 for enterprise scalability. In the PoC demonstration, scalability starts at 1000 web applications. Will the solution be connected to all 1000 systems in the PoC or will scalability to 1000 and then to 1500 be assessed some other way?

Government Response: For the Proof of Concept (PoC), the solution will initially be connected to the first 100 systems. Scalability to 1000 and then to 1500 systems will be assessed at a later stage, beyond the initial PoC.

91. Is a SaaS-based deployment acceptable for the cloud-based deployment, or must it run in VA’s VAEC?

Government Response: The solution shall be vendor managed and the government is open to considering both on-premises and cloud-based deployments, including VAEC, as long as the solution is entirely vendor-managed. This means that a SaaS model would also be considered acceptable.

92. This requirement stipulates that the solution shall be a comprehensive, vendor-managed system. Bullet #3 stipulates an on-premises deployment and a cloud-based (presumably VAEC). Is VA looking for a managed service form factor for the on-premises and VAEC instances? Would a SaaS model be considered?

Government Response: The solution shall be vendor managed and the government is open to considering both on-premises and cloud-based deployments, including VAEC, as long as the solution is entirely vendor-managed. This means that a SaaS model would also be considered acceptable.

93. Is the intent of these integrations to supply events, alerts, and data to them, or is it something more? If more, please provide the expectations of these integrations.

Government Response: The intent is to supply event data, alerts, and data.

94. Could the RFI please be extended by 1 week to allow additional time to generate a response that meets the VA's requirements?

Government Response: No

95. Would you be able to provide an extension to March 7th?

Government Response: No

96. Can you please tell me if there is an incumbent?

Government Response: There are no incumbents.

97. What is the proposed timeframe of the initial installation? Will this happen prior to the end of the government Fiscal Year?

Government Response: Yes

98. How many workloads would be part of the 1000-1500 applications for enterprise deployment? Containers? VMs? Serverless functions?

Government Response: Unknown currently

99. Could you provide more detail on how the proof-of-concept (POC) will be executed?

Government Response: Vendors should recommend and propose POC for their solution.

100. Is the requirement that the solution be on-perm or a cloud-based solution?

Government Response: The solution can be cloud, hybrid, or on-premises.

101. Could you provide more detail about the requirement for synchronized policies between NGFW, WAF and RASP?

Government Response: The requirement for synchronized policies across Next-Generation Firewalls (NGFWs), Web Application Firewalls (WAFs), and Runtime Application Self-Protection (RASP) ensures that security controls are coordinated, consistent, and effective across different layers of protection. Because these technologies operate at different points in the security stack, policy synchronization is required to prevent security gaps caused by inconsistent rule enforcement. Also to avoid redundant or conflicting rules that could create operational inefficiencies and to enable automated threat response by ensuring that detections at one layer inform protections at others.

102. Please provide total traffic volume for the 100-application pilot, 1,000 initial applications and eventual 1,500+ applications.

Government Response: Unknown currently.

103. Would the govt consider giving responders more than 4 days to respond after the questions have been answered?

Government Response: No