The Department of Veterans Affairs has issued a Sources Sought Notice for the VA Server Enterprise Endpoint Security (VASEES) Request for Information (RFI) under solicitation number 36C10B25Q0203. The notice is aimed at gathering input from potential vendors regarding endpoint security solutions and associated services. The contracting office is located in Eatontown, NJ, and the deadline for responses is set for March 20, 2025, at 12:00 PM Eastern Time. The notice references attachments that encompass a draft Performance Work Statement (PWS) and a series of questions regarding the RFI. Additional documentation includes service level agreements and specific requirements for endpoint detection and response systems. This engagement appears to be part of the federal government's strategy to enhance cybersecurity measures for the VA’s IT infrastructure, reflecting increasing priorities on security and compliance in federal operations. The point of contact for inquiries is Contract Specialist Dana Seeler, whose email is provided for direct communication. Overall, this notice outlines the VA's intention to assess the market for potential solutions that fulfill its security objectives.

The VASEES Service Level Agreements (SLA) outline performance expectations for a contractor providing services to the VA. Key SLAs include a two-hour engineering response time, 24/7 network monitoring with a 15-minute outage notification, and a commitment to 99.9% service availability. Should service availability fall below this threshold, the VA can request service credits proportional to the level of non-compliance. The contractor is required to monitor system load and utilization to ensure efficiency, with specific thresholds for CPU and memory usage. Support response times vary by severity level: critical issues demand a 30-minute response, serious problems require one hour, moderate issues four hours, and minimal requests one day. Performance levels must be validated within 30 days of contract award, including routine testing and reporting to maintain compliance. The document emphasizes accountability, outlining how service credits will be structured if SLAs are not met, reinforcing the contract's terms while ensuring continuous support for VA operations. The SLA serves as a critical element in government contracts, ensuring that contractors uphold their obligations and provide reliable service to federal clients.

The document outlines a Request for Proposal (RFP) for an Endpoint Protection Platform (EPP) designed for the Veterans Affairs (VA). It specifies general and operational requirements for a scalable, enterprise-grade host endpoint monitoring solution. Key features include FIPS 140-2 encryption for data security, modularity for component updates, and extensive application and network control capabilities. The solution must support various operating systems and integrate seamlessly with existing IT infrastructure, including SIEM and SOAR systems. Performance and operational metrics highlight the need for real-time threat analysis, malicious file containment, and data collection, ensuring minimal resource impact on host systems. Furthermore, the EPP solution should enable remote management capabilities, detailed reporting options, and adherence to federal compliance standards like NIST and 508 compliance. The focus on user access control, automated response to threats, and forensic investigation capabilities illustrates a comprehensive cybersecurity strategy, essential in protecting sensitive data and maintaining operational integrity across the VA's network. This RFP emphasizes the necessity for modern security solutions that can adapt to evolving threats while supporting the VA's mission to serve veterans effectively.

The Performance Work Statement (PWS) outlines the Department of Veterans Affairs' (VA) requirement for the VA Server Enterprise Endpoint Security (VASEES) system, designed to deliver comprehensive cybersecurity for up to 750,000 physical, virtual, and cloud-hosted clients. The contractor is responsible for deploying a Software as a Service (SaaS) solution, obtaining necessary authorizations, and maintaining high levels of security through compliance with federal guidelines, including FISMA and FedRAMP standards. The scope includes project management, staffing plans, training, and operational support. Key deliverables encompass a detailed project management plan, continuous monitoring and maintenance of the VASEES solution, and training for VA personnel. The contractor must ensure documentation, help desk scripts, and support infrastructure are in place to facilitate effective user interaction with the system. The contract spans an initial twelve-month period, extendable over four additional years, allowing for incremental asset licensing and scalability. This PWS reflects the VA’s commitment to enhancing cybersecurity practices while adhering to federal regulations, ensuring the safe management of sensitive information across all VA operations.

The Request for Information (RFI) for the VA Server Enterprise Endpoint Security (VASEES) is issued for planning purposes and does not obligate the government to procure any products or services. It invites vendors to provide insights regarding their capabilities specific to endpoint security solutions anticipated for the management of up to 750,000 devices. Interested vendors are instructed to submit detailed information within a 15-page limit, excluding marketing materials, and must include business size, NAICS codes, and a summary of their proposed solutions. Key areas of response include the scalability of technology, integration with existing cybersecurity systems, operational staffing plans to support 24/7 operations, and the readiness for FedRAMP certification. Vendors are also asked to outline pricing models and provide details about their experience with federal contracts. Responses are due by March 20, 2025, with submissions sent via email and marked for proprietary information. This RFI serves as a preparatory step for assessing market capabilities in achieving comprehensive endpoint protection for the VA's server enterprise.