DF01--VA Server Enterprise Endpoint Security (VASEES)-New Award (VA-25-00011736)

The Department of Veterans Affairs Technology Acquisition Center is seeking a Software as a Service (SaaS) enterprise endpoint security solution through the VA Server Enterprise Endpoint Security (VASEES) program. The procurement will provide comprehensive cybersecurity host-based protection for up to 750,000 physical, virtual, and cloud-hosted clients across the VA enterprise, supporting multiple operating systems including Windows, Linux, Unix, and VMware in both on-premises and cloud environments. Key requirements include 99.9% solution availability, FedRAMP High authorization, 24x7x365 operational support, comprehensive monitoring and incident response capabilities, and integration with existing VA security infrastructure. The solution must demonstrate scalability from 75,000 devices up to 750,000 devices, with capabilities for malware detection, application control, threat hunting, forensics, and behavioral analytics while maintaining functionality for air-gapped networks. The government plans to release the unrestricted solicitation on the NASA SEWP V Government-Wide Acquisition Contract under NAICS code 541519 in early to mid-August, with the initial Request for Information responses having been due March 20, 2025.

This opportunity includes no set-aside designation and will be competed as an unrestricted procurement. The contract structure includes a base period covering program management and licensing for 75,000 servers, followed by four 12-month option periods with a 3% year-over-year increase in requirements. The solution must initially support at least 200,000 devices with scalability to over 600,000 endpoints, and the contractor must provide comprehensive training sessions, help desk support, and maintain detailed documentation including standard operating procedures. Five optional tasks are included for additional enterprise server and workstation licenses, enhanced support services, training, and transition support. Performance requirements are stringent, including 2-hour engineering response times for critical issues, 15-minute notification of network outages, and mandatory root cause analysis for any SLA failures, with service credits ranging from 5% to 25% based on measured performance below the 99.9% availability threshold.