VA-26-00050029 User and Entity Behavior Analytics (UEBA) Solution

The Department of Veterans Affairs Technology Acquisition Center is conducting a pre-solicitation for a User and Entity Behavior Analytics (UEBA) Solution under solicitation VA-26-00050029. This Sources Sought Notice (RFI) is for information and planning purposes only and does not constitute a formal solicitation or commitment to award a contract at this time. Prospective vendors must submit responses by 12:00 PM CST on March 13, 2026, to Marcela.Clark2@va.gov with required information including company name, points of contact, Unique Entity ID, CAGE code, small business status, the specific tool being offered, and FedRAMP certification level or timeline for obtaining certification. The anticipated contract will be awarded as a Firm-Fixed Price agreement to a single responsive and responsible contractor. Submission requirements include identification of the specific UEBA solution or equivalent system being offered, with authorization documentation such as reseller letters if applicable.

The procurement involves implementing a comprehensive host-based UEBA solution to enhance cybersecurity threat detection and incident response capabilities across the VA enterprise, serving approximately 600,000 users and over 1 million endpoints. The base contract period runs from July 1, 2026, through June 30, 2027, with two optional 12-month renewal periods for a potential 36-month total performance period. Key implementation requirements include phased deployment with Phase I establishing 1,000 test agents within 90 days, Phase II deploying 50,000 agents within 120 days, and Phase III achieving enterprise deployment of approximately 600,000 agents within 150 days of contract award. The solution must deliver real-time and near-real-time anomaly detection using artificial intelligence and machine learning, maintain 99.9% uptime availability with active-active disaster recovery architecture, support multiple deployment models, and integrate with existing VA security platforms including Splunk, ServiceNow, Swimlane, and MS Sentinel. All contractor personnel require High Risk (Tier 4) level background investigations, and the solution must comply with NIST SP 800-53 Rev. 5, FIPS 140-3, Section 508 accessibility standards, and VA-specific security directives including comprehensive data protection requirements with liquidated damages of $37.50 per affected individual in case of data breach.