RFI Description.docx

US Department of Veterans Affairs (VA) Office of Information and Technology (OIT)

Data Loss Prevention (DLP) and Data Access Governance (DAG) Infrastructure Solution

Request for Information (RFI)

This is a Request for Information (RFI) only issued for conducting market research. Accordingly, this RFI constitutes neither a Request for Quote (RFQ), Request for Proposal (RFP), nor a guarantee that one will be issued by the Government in the future; furthermore, it does not commit the Government to contract for any services described herein. The Department of Veterans Affairs (VA) is not, at this time, seeking proposals or quotes, and therefore, will not accept, review, or evaluate unsolicited proposals or quotes received in response hereto. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted because of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or reimburse expenses incurred for responses to this RFI. The information provided may be used by VA in developing its acquisition strategy and Performance Work Statement (PWS) or Product Description (PD). Any information submitted by respondents to this RFI is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the respondent. Interested parties are responsible for adequately marking proprietary, restricted, or competition sensitive information contained in their response. Product information, brochures, part numbers, and/or other description information may be included with the submission. VA is under no obligation to provide feedback to the RFI respondent, or to contact the RFI respondent for clarification of any information submitted as part of the response.

Requirement:

The Department of Veterans Affairs (VA), Office of Information and Technology and Infrastructure Operations, requires a single-vendor Commercial Off-the-Shelf Data Loss Prevention (DLP) Infrastructure Solution for the VA Enterprise. The solution must deliver fully functional, integrated, enterprise-wide DLP capabilities covering data discovery, classification, protection, access governance, and continuous monitoring across network, cloud, and storage environments. Licenses must support a minimum of 700,000 users for the entire period of performance. The DLP solution shall meet all VA cybersecurity, governance, and federal compliance requirements, including alignment with Federal Risk and Authorization Management Program (FedRAMP) Moderate and Federal Information Security Management Act (FISMA) Moderate controls. The solution shall support delegated access governance, data classification, automated policy enforcement, and owner-led access reviews in accordance with VA Chief Information Security Officer objectives.

The attached Product Description – Data Loss Prevention and Data Access Governance Infrastructure Solution describes the technical specifications for this effort.

RFI Submission Instructions:

VA requests a clear, concise, and complete response to this RFI. Please submit your RFI response in accordance with the following:

1) Include the following identification information:

a. Name of Company

b. Address

c. Point of Contact

d. Phone Number

e. Email address

f. CAGE/Unique Entity ID (UEI) Number

g. Company Business Size and NAICS code(s). For VOSB and SDVOSBs, proof of certification in the SBA Veteran Small Business Certification Program and listed in the SBA certification database (see 13 CFR 128.102).

h. Any Schedules held on General Services Administration (GSA), Government-Wide Acquisition Contracts (GWAC) held on the National Aeronautics and Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) V, or any other schedule not mentioned above to assist in determining acquisition strategy if you are included in one or more. Please also include Contract Number, expiration date, etc.

i. Socioeconomic data: If a small business, what type of small business are you? Are you able to comply with FAR 52.219-6 and 52.219-14 in execution of this effort? Are you able to comply with VAAR 852.219-73, VA Notice of Total Set-Aside for Certified Service-Disabled Veteran-Owned Small Businesses or VAAR 852.219-74, VA Notice of Total Set-Aside for Certified Veteran-Owned Small Businesses.

2) Corporate experience or expertise in performing these services and specific examples or references. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

3) Has the draft PD provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer question 4)

4) If “NO”, please provide your technical comments/recommendations on elements of the draft PD that may contribute to a more accurate proposal submission and efficient, cost-effective effort.

5) BILL OF MATERIALS (BOM: Provide a detailed BOM that includes part numbers, quantities and a description of all products in the form of a quote that includes pricing per part number. BOMs shall be provided for any Optional Tasks, where applicable as well.

6) SCHEDULE B / PRICE SCHEDULE: Provide a Rough Order of Magnitude (ROM), in the form of a completed Schedule B / Price Schedule (attached), for the support services listed in the draft PD. The estimate shall include pricing for Items #1-21, to include MSRP Pricing and VA Unit Pricing. The spreadsheet includes formulas to calculate a total for each item, as well as the overall total.

7) VENDOR SUPPLEMENTAL QUESTION: If a vendor proposes an alternative brand to Varonis, please provide a proposal to address maintaining continuity of operations by sustaining the existing Varonis licensing and support for the duration of the transition in accordance with the requirements of the PD. The proposal should include a detailed description, along with a BOM that includes part numbers, quantities and a description of all products in the form of a quote that includes pricing per part number.

8) COMPLIANCE MATRIX: Provide a completed Compliance Matrix (attached).

The Government will not review any other information or attachments included, that are in excess of the 10-page limit. The Government will not review generic marketing materials that do not address the information contained herein or the attached documents.

All interested parties shall respond no later than 12:00 PM EST on May 14, 2026 via e-mail. If you have any questions on the RFI, please submit via the SAM.gov. Please note Data Loss Prevention and Data Access Governance Infrastructure Solution in the subject line of your response.

The TAC point of contact for this RFI is Contract Specialist, Kevin Andujar, Email address: Kevin.Andujar@va.gov.

See attached documents: Product Description – Data Loss Prevention and Data Access Governance Infrastructure Solution, DLP and DAG Infrastructure Solution - RFI Schedule B Price Model Spreadsheet, and Compliance Matrix