VA-26-00050029 User and Entity Behavior Analytics (UEBA) Solution

This Sources Sought Notice from the Department of Veterans Affairs (VA) Office of Research and Development (ORD) is for information and planning purposes only, seeking a User and Entity Behavior Analytics (UEBA) solution, specifically a brand name HID Global ActiVID Validation Authority (VA) and Online Certificate Status Protocol (OCSP) responder solution, or an equivalent. The VA requires a system capable of enterprise-wide certificate validation services for over 2 million identities, supporting all software licenses, installation, configuration, and professional support services. The solution must meet stringent salient characteristics for validation, OCSP, API connectivity, reliability, and security, including Post Quantum Compliance and adherence to various federal accessibility and energy-efficiency laws. The anticipated NAICS code is 541519, and a Firm-Fixed Price contract is expected to be awarded to a single contractor. Responses are due by March 13, 2026, at 12:00 PM CST, and must include company information, small business status, proposed tool, and FedRAMP certification level.

The Department of Veterans Affairs (VA) Office of Information & Technology (OIT) and Office of Information Security (OIS) seek a contractor to provide a Host-Based User and Entity Behavior Analytics (UEBA) solution. This Performance Work Statement (PWS) outlines the need for a comprehensive system to detect and mitigate cyber threats by analyzing user, account, and host behaviors using AI/ML. The solution must comply with numerous federal and VA cybersecurity regulations, including FISMA, HIPAA, FIPS, and NIST standards, and support IPv6, Zero Trust Architecture, and FedRAMP-certified cloud environments. Key requirements include real-time threat detection, automated alerting, data encryption, high availability, and integration with existing VA security platforms like Splunk and ServiceNow. The contractor will be responsible for project management, implementation, configuration, engineering support, 24/7 customer service, testing, and disaster recovery. The implementation will occur in three phases, aiming for enterprise-wide deployment to approximately 600,000 agents within 150 days.