DA01--Zero Trust Application Realtime Protection (ZARP) RFI (VA-25-00050847)

The Department of Veterans Affairs Technology Acquisition Center Austin is seeking a comprehensive Zero Trust Application Realtime Protection (ZARP) solution to enhance cybersecurity for web applications. The Request for Information (RFI) targets a Runtime Application Self-Protection (RASP) system capable of protecting 100 applications initially, with potential scaling to 1,000-1,500 applications enterprise-wide. Key technical requirements include runtime threat detection, context-aware security, self-protection mechanisms, and integration with tools like Splunk, supporting both Windows and Linux operating systems. Vendors must be FedRAMP compliant and adhere to the latest NIST security standards, with a 10-page submission limit for their proposal. The response deadline is March 26, 2025, at 1:00 PM Eastern Time, with Contract Specialist Michael Berberich managing the solicitation process.

The opportunity falls under NAICS code 541519 for Other Computer Related Services, with a size standard of $34 million and a preference for Veteran-Owned Small Businesses (VOSB) and Service-Disabled Veteran-Owned Small Businesses (SDVOSB). The VA is considering various deployment models, including on-premises, hybrid, and cloud-based solutions, with an initial 6-month proof-of-concept phase and deployment expected within 10 business days after award. The solution must synchronize policies across Network Firewalls (NGFW), Web Application Firewalls (WAF), and RASP, with capabilities to detect and potentially remediate vulnerabilities. While specific contract value details are not explicitly stated, the comprehensive nature of the requirements suggests a significant investment in cybersecurity infrastructure. The VA anticipates a contract structure that includes a base year with potential four-year option periods, targeting protection against OWASP vulnerabilities, zero-day attacks, and other sophisticated cybersecurity threats.