Inactive

REQUEST FOR INFORMATION DESCRIPTION Department of Veterans Affairs Request for Information (RFI) Production Web Application Protection This is a Request for Information (RFI) only. Do not submit a quo... REQUEST FOR INFORMATION DESCRIPTION Department of Veterans Affairs Request for Information (RFI) Production Web Application Protection This is a Request for Information (RFI) only. Do not submit a quote. This RFI is for planning purposes only and shall not be considered a Request for Quotation. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for quotes or the authority to enter into negotiations to award a task order. No funds have been authorized, appropriated or received for this effort. The information provided may be used by the Department of Veterans Affairs (VA) in developing its acquisition strategy. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI. The Government requests Industry to review and provide commentary on the Governments requirement detailed below. The Government intends to review RFI responses to exchange information and improve industry s understanding of the Government requirement and the Government s understanding of industry capabilities. This will allow potential offerors to judge whether or how they can satisfy the Government s requirements and enhance the Government s ability to obtain quality supplies and services. SUBMITTAL INFORMATION: All responsible sources may submit a response in accordance with the below information. As part of your market research response, please provide a 10-page submission detailing similar work experience to that of the Governments requirement detailed below. Interested vendors shall provide constructive comments and/or feedback regarding the following elements of the proposed procurement: Proposed contract type: Firm Fixed Price Schedule: Base Year plus four (4) option years Industry to propose a Contract Line-Item Number (CLIN)/Price Structure and deliverables; Industry to propose the Team level of effort and labor categories Feasibility of the requirement, including performance requirements Any other industry concerns, comments, or questions Interested Vendors shall provide the following information in the initial paragraph of the submission: Name of Company Address Point of Contact Phone Number Email address Company Business Size and Status under the following North American Industry Classification System (NAICS) Code: 541519 Other Computer Related Services with a Size Standard of $34 Million. Existing Contractual Vehicles (GWAC, FSS, MAC, SEWP) to include the contract and schedule numbers. Socioeconomic data (For Veteran-Owned Small Business (VOSB) and Service-Disabled Veteran-Owned Small Business (SDVOSB)s, proof of verification in Small Business Administration (SBA) Veteran Small Business Certification (VetCert)) Indicate whether you can comply with the limitations on subcontracting at VA Acquisition Regulation (VAAR) 852.219-73, VA Notice of Total Set-Aside for Certified Service-Disabled Veteran-Owned Small Businesses or VAAR 852.219-74 VA Notice of Total Set-Aside for Certified Veteran-Owned Small Businesses System for Award Management Unique Identity Identification Number While not required, artifacts supporting your submission may be submitted to better demonstrate the above. The artifacts can be in addition to the page limit. There are no specific submission requirements other than the page limit, but the Government requests that it not be inundated with marketing materials or peripheral content, and that the submission be readable. CONTRACTOR RESPONSE: All Contractor questions are required to be submitted via email no later than 12:00 PM ET, February 28, 2025 to Michael Berberich, Contract Specialist at michael.berberich@va.gov and Contracting Officer David Long at david.long4@va.gov. Once all of the questions have been received, the Government will provide a response and extend the RFI an additional four business days to allow industry time to provide their formal response. GOVERNMENT REQUIREMENT: VA requires a comprehensive application security solution to protect applications from exploitation by threat actors, unauthorized system access, data breaches, and service disruptions. The solution Address vulnerabilities as defined by Open Worldwide Application Security Project (OWASP) that may not be caught during static scanning in software development. Key challenges this solution Address include: Protection against known OWASP vulnerabilities. Defense against zero-day attacks through runtime protection. Support for both modern and legacy applications across diverse operating systems. Integration with existing VA security infrastructure including Palo Alto Next Generation Firewalls (NGFW). Enterprise scalability while starting with initial deployment of 100 systems. Minimal performance impact on protected applications. Comprehensive logging and security analytics capabilities. The vendor shall provide details on the solution including: Hardware and software required. Hardware, software and/or cloud requirements. Installation requirements. Licensing (including type of licensing, i.e., annual, perpetual, etc.) and maintenance requirements. What is included with licensing and maintenance. Description of warranty. Adapter requirements. Description of training for government full-time equivalents (FTEs) employees. Operation/Customization Capabilities of the Solution Virtual lab usage and materials Description of professional services provided. Any features not specifically mentioned, but which may be required and necessary for the completeness and efficient performance of the proposed solution as an operating entity. Appendix A-Detailed Operating and Capability List (see below), includes a full list of requirements that the vendor is requested to provide a response to. For each line a response shall be provided about whether the solution can fully meet the requirement or not as shown with the check boxes. Parameters include: The solution shall provide both Web Application Firewall (WAF) and Runtime Applications Self-Protection (RASP) capabilities, either as an integrated platform or as compatible, interoperable components with the existing Next Generation Firewalls (NGFW). The solution shall be scalable to protect at least 1,000 web applications across the VA's infrastructure, with the capability to expand to 1,500 applications within two years. The solution shall support both on-premises and cloud-based deployments, including hybrid environments, aligning with the VA's cloud migration strategy. The solution shall offer centralized management and monitoring capabilities for all protected applications, providing a single pane of glass view for security operations. The solution shall be a comprehensive, vendor-managed system that includes ongoing support, maintenance, updates, performance monitoring, and reporting. The reporting must feature metrics and benchmarks to demonstrate the effectiveness of the solution. The solution shall interface and provide integrations to VA Security information and event management (SIEM) , Continuous Monitoring (ConMon), and Incident response platforms (e.g. SPLUNK, ServiceNow) The solution must comply with relevant government security standards, including Federal Information Security Management Act of 2002 (FISMA), Federal Risk and Authorization Management Program (FedRAMP), Federal Information Security Management Act of 2002 (FISMA), and Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), while maintaining compliance with evolving regulations and emerging federal standards such as the latest National Institute of Standards and Technology (NIST) updates. ADDITIONAL QUESTIONS TO BE ANSWERED BY INDUSTRY IN THE RFI RESPONSE: Licensing - What is included as part of the licensing model? (i.e., perpetual, concurrent, subscription-based, proprietary, network, other)? Is support included as a part of licensing? Does the license have the flexibility to increase licenses to your current configurations over time? Do the licenses need to be installed or can VA install? Please describe what is included in ongoing support, maintenance, updates, and performance monitoring. What metrics and benchmarks do you provide that measure and proves the effectiveness of the solution in protecting application? Maintenance - Will the maintenance renewal be annual, or can you provide a quote to estimate for 4 (four) years of maintenance? What does the maintenance renewal cover (updates, patches, support, etc.)? Training - What type of Software training is offered (i.e., user training, technical training/knowledge transfer, etc.)? How many days does Software Training consist of? Is the training on-site, remote, or virtual? What is the cost of Training? Please provide a Pricing Estimate for an enterprise license to include a proof of concept funding scenario for 6 months, annual maintenance costs or annual licensing costs, any additional support costs, any additional service costs, training costs, and any costs not otherwise specified or identified. How is the effectiveness of the proposed solution measured? Appendix A Detailed Operating and Capability List The Contractor shall provide a response to each line in the list. Responses requested for each line are Fully Capable or Not Capable. ITEM # Requirement Fully Compliant Not Compliant 1 Runtime Threat Detection and Prevention Provide real-time threat detection and prevention at the application runtime, with a response time of less than 10 milliseconds. Protect against zero-day vulnerabilities and novel attack vectors, with the demonstrated ability to prevent previously unknown attacks. 2 Application Compatibility and Performance Impact Support major programming languages and frameworks used by the VA, including but not limited to Java, .NET, Python, Node.js Be fully compatible with both legacy and modern VA applications, enabling protection without requiring extensive modifications to existing systems. Maintain less than 5% overhead in application response times, even under high-load transaction scenarios, to ensure negligible impact on end-user experience and application functionality. 3 Traffic Inspection and Filtering (WAF/NGFW) Inspect and filter all incoming Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS) traffic, with the capacity to process at least 100,000 requests per second during peak usage without compromising performance. Support both positive security models (allowlisting) and negative security models (blocklisting), with the flexibility to switch or combine models based on application-specific requirements. Provide robust protection against the OWASP Top 10 vulnerabilities, with regular signature and behavior-based updates to address emerging threats and attack techniques. Achieve a 50% reduction in successful web application attacks within the first year of full implementation, as verified through periodic security incident reports and analytics. 4 Protocol Validation and Bot Mitigation Must validate HTTP/HTTPS protocols to prevent protocol-based attacks, including HTTP desync attacks. Offer Transport Layer Security (TLS)/Secure Sockets Layer (SSL) termination and inspection capabilities, supporting TLS 1.2 and 1.3. Include advanced bot detection and mitigation capabilities using artificial general intelligence (AI) and machine learning, with a false positive rate of less than 0.1%. to 1% 5 Distributed Denial-of-Service (DDoS) Protection and Performance Provide protection against application layer (Layer 7) DDoS attacks, capable of mitigating attacks of up to 10 Gbps. Offer integration with network-layer DDoS protection solutions already in use by the VA, including the NGFW. 6 Cross-System Integration Integrate with existing VA security information and event management (SIEM) systems, including [specific SIEM solution used by VA], with bi-directional data flow from NGFW, WAF, and RASP. Provide APIs for custom integrations with other VA security tools, including [list of specific tools used by VA], with comprehensive documentation and support. 7 Identity and Access Management Integrate with the VA's identity and access management systems, including Okta and Active Directory, ensuring role-based access control across NGFW, WAF, and RASP. Offer unified threat intelligence across all components, with the ability to share threat data across the entire VA network. 8 Compatibility and Configuration Integrate seamlessly with the VA s existing Palo Alto NGFW solution, ensuring no disruption to existing configurations. The solution Synchronize security policies across NGFW, WAF, and RASP to prevent conflicts and ensure a unified approach to traffic inspection and filtering. The NGFW must retain its role in network-layer protection while delegating application-layer protection to WAF and runtime threat prevention to RASP. 9 Data Flow and Protocols The integration Support bi-directional data flow between NGFW, WAF, and RASP, allowing threat intelligence and logs to be shared across systems. The solution Support standard communication protocols such as HTTP, HTTPS, TLS 1.2/1.3, and integration with SIEM systems already used by the VA. 10 Performance and Monitoring The integrated solution Maintain optimal performance with minimal impact on network latency, ensuring that traffic inspection remains efficient across all three systems. Monitoring Occur through a centralized dashboard that aggregates logs and performance metrics from NGFW, WAF, and RASP. 11 Centralized Monitoring and Reporting Provide a unified dashboard for monitoring NGFW, WAF, and RASP security events, with real-time updates and customizable alerts. Offer customizable views for different stakeholders (e.g., security teams, application owners, executives), with role-based access control. Provide detailed logging of security events from NGFW, WAF, and RASP, with log retention for at least one year to support forensic analysis. 12 Performance Scalability Maintain high availability and fault tolerance across all systems, with 99.99% uptime guaranteed. Support active-active configurations for high traffic volumes, capable of load balancing across multiple data centers. 13 Unified Deployment and Management Support various deployment options (e.g., agent-based, container-based for RASP; appliance-based, cloud-based for WAF), compatible with VA's existing infrastructure. Provide centralized policy management, allowing for consistent policy enforcement across all VA facilities. Support policy version control and rollback capabilities across all systems, with the ability to track changes and revert to previous configurations if needed. 14 Compliance Aid in meeting and demonstrating compliance with FISMA, HIPAA, and FedRAMP requirements, providing necessary documentation and audit support. Provide data masking capabilities to protect sensitive veteran information, including Social Security numbers, health records, and personal identifiers. 15 Security Support encryption of data in transit and at rest, using FIPS 140-2 validated cryptographic modules across all integrated systems. Provide audit trails for all administrative actions and policy changes, with tamper-evident logging for NGFW, WAF, and RASP. Provide a FedRAMP authorization if cloud deployed, and support for an Authority to Operate (ATO) in the VA Risk Management Framework (RMF). 16 Interfaces Provide integrations to VA s SIEM, ConMon, and Incident Response Platforms.