ZARP RFI V2-SAM.docx

REQUEST FOR INFORMATION

DESCRIPTION

Department of Veterans Affairs Request for Information (RFI) Production Web Application Protection

This is a Request for Information (RFI) only. Do not submit a quote. This RFI is for planning purposes only and shall not be considered a Request for Quotation. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for quotes or the authority to enter into negotiations to award a task order. No funds have been authorized, appropriated or received for this effort. The information provided may be used by the Department of Veterans Affairs (VA) in developing its acquisition strategy. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

The Government requests Industry to review and provide commentary on the Governments requirement detailed below. The Government intends to review RFI responses to exchange information and improve industry’s understanding of the Government requirement and the Government’s understanding of industry capabilities. This will allow potential offerors to judge whether or how they can satisfy the Government’s requirements and enhance the Government’s ability to obtain quality supplies and services.

SUBMITTAL INFORMATION:

1. All responsible sources may submit a response in accordance with the below information. As part of your market research response, please provide a 10-page submission detailing similar work experience to that of the Governments requirement detailed below.

2. Interested vendors shall provide constructive comments and/or feedback regarding the following elements of the proposed procurement:

a. Proposed contract type: Firm Fixed Price

b. Schedule: Base Year plus four (4) option years

c. Industry to propose a Contract Line-Item Number (CLIN)/Price Structure and deliverables;

d. Industry to propose the Team level of effort and labor categories

e. Feasibility of the requirement, including performance requirements

f. Industry to provide estimated pricing.

g. Any other industry concerns, comments, or questions

3. Interested Vendors shall provide the following information in the initial paragraph of the submission:

a. Name of Company

b. Address

c. Point of Contact

d. Phone Number

e. Email address

f. Company Business Size and Status under the following North American Industry Classification System (NAICS) Code: 541519 “Other Computer Related Services” with a Size Standard of $34 Million.

g. Existing Contractual Vehicles (GWAC, FSS, MAC, SEWP) to include the contract and schedule numbers.

h. Socioeconomic data (For Veteran-Owned Small Business (VOSB) and Service-Disabled Veteran-Owned Small Business (SDVOSB)s, proof of verification in Small Business Administration (SBA) Veteran Small Business Certification (VetCert))

i. Indicate whether you can comply with the limitations on subcontracting at VA Acquisition Regulation (VAAR) 852.219-73, VA Notice of Total Set-Aside for Certified Service-Disabled Veteran-Owned Small Businesses or VAAR 852.219-74 VA Notice of Total Set-Aside for Certified Veteran-Owned Small Businesses

j. System for Award Management Unique Identity Identification Number

While not required, artifacts supporting your submission may be submitted to better demonstrate the above. The artifacts can be in addition to the page limit.

There are no specific submission requirements other than the page limit, but the Government requests that it not be inundated with marketing materials or peripheral content, and that the submission be readable.

CONTRACTOR RESPONSE:

All Contractors shall submit via email no later than 1:00 PM ET, March 26, 2025 to Michael Berberich, Contract Specialist at michael.berberich@va.gov and Contracting Officer David Long at david.long4@va.gov.

GOVERNMENT REQUIREMENT:

VA requires a turnkey application security solution to protect applications from exploitation by threat actors, unauthorized system access, data breaches, and service disruptions. The solution shall address vulnerabilities defined by Open Worldwide Application Security Project (OWASP). The Government intends to have an initial deployment of 100 system with an eventually rollout enterprise wide.

Key features of this solution include:

· Identify, protect, detect, respond, and recover in real-time against:

· OWASP vulnerabilities

· Business logic attacks

· 0-Day attacks

· Memory exploits

· Runtime attacks

· API security risks

· DDos attacks

· Supports Windows, Linux, and cloud environments with no less than 5% overhead.

· Integrate with existing VA security tools (example: Palo Alto NGFW, Splunk, and ServiceNow).

· Comply with relevant government security standards, including Federal Information Security Management Act of 2002 (FISMA), Federal Risk and Authorization Management Program (FedRAMP), Federal Information Security Management Act of 2002 (FISMA), and Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), while maintaining compliance with evolving regulations and emerging federal standards such as the latest National Institute of Standards and Technology (NIST) updates.

· Web Application Firewall (WAF) and Runtime Applications Self-Protection (RASP) capabilities, either as an integrated platform or as compatible, interoperable components with the existing Next Generation Firewalls (NGFW).

· Support programming languages and frameworks used by the VA, including but not limited to Java, .NET, Python, Node.js

· Support various deployment options (e.g., agent-based, container-based for RASP; appliance-based, cloud-based for WAF) compatible with VA's existing infrastructure.

· Provide agent-based protection for applications that are in sustainment and other non-development applications, including legacy and production systems that are operational but not actively undergoing software changes.

· Provide developer-integrated security hook protections for applications that are in production and pre-production states, while integrating with CI/CD pipelines to embed security into the application.

· Logging and security analytics in Splunk.

· Turnkey services approach to include:

· Continuous operation

· Centralized management and monitoring

· Incident response

· DevSecOps integration

· System administration

· Training

Vendors shall respond to the following:

1. Explain how the solution meets the requirements listed above.

2. Hardware, software, adapter, cloud, or other requirements for the solution.

3. Explain how agent operate for sustainment applications including any dependencies and limitations.

4. Describe the solutions scalability to protect web applications – how many is it capable of protect?

5. Does the solution integrate with the CI/CD pipeline? (Describe how it enforces security policies during development and ensures self-protection in production.)

6. Discuss the ease of integration with VA’s existing tools and provide examples of previous successful integrations with similar tools.

7. Provide metrics to verify the effectiveness of the proposed solution to include:

· False Positive Rate: The percentage of benign activities incorrectly identified as threats by the solution.

· False Negative Rate: The percentage of actual threats that the solution fails to detect.

· Crossover Error Rate (CER): The rate at which the false positive rate and the false negative rate are equal.

· System Uptime: The percentage of time the solution is operational and available.

· Scalability Metrics: The ability of the solution to handle increased loads, such as the number of applications or transactions it can protect without performance degradation.

· Integration Time: The average time required to integrate the solution with existing systems and tools.

· User Training Completion Rate: The percentage of users who successfully complete the training provided by the vendor.

· Update Frequency: How often the solution is updated with new detection and protection capabilities.

· Support Response Time: The average time taken by the vendor’s support team to respond to and resolve support tickets.

· Mean Time to Detect (MTTD): The average time taken to detect a security incident.

· Resource Utilization: The amount of system resources (CPU, memory, etc.) used by the solution during peak operation.

8. Licensing details:

· What are the types of licenses offered? (e.g., perpetual, subscription-based, concurrent, etc.)

· How is the software priced? (e.g., per user, per device, per usage, etc.)

· Are there different tiers or editions of the software? (e.g., basic, professional, enterprise)

· What is included in the license? (e.g., support, updates, additional features)

· Are there any additional costs? (e.g., for maintenance, support, or upgrades)

· What are the terms of the license agreement? (e.g., duration, renewal process, termination conditions)

· What happens when license usage are exceeded? (e.g., additional fees, service interruption)

· Are discounts available for volume purchases or long-term commitments?