The Department of Veterans Affairs has issued a Sources Sought Notice for the VA Server Enterprise Endpoint Security (VASEES) Request for Information (RFI) under solicitation number 36C10B25Q0203. The notice is aimed at gathering input from potential vendors regarding endpoint security solutions and associated services. The contracting office is located in Eatontown, NJ, and the deadline for responses is set for March 20, 2025, at 12:00 PM Eastern Time. The notice references attachments that encompass a draft Performance Work Statement (PWS) and a series of questions regarding the RFI. Additional documentation includes service level agreements and specific requirements for endpoint detection and response systems. This engagement appears to be part of the federal government's strategy to enhance cybersecurity measures for the VA’s IT infrastructure, reflecting increasing priorities on security and compliance in federal operations. The point of contact for inquiries is Contract Specialist Dana Seeler, whose email is provided for direct communication. Overall, this notice outlines the VA's intention to assess the market for potential solutions that fulfill its security objectives.

The Department of Veterans Affairs (VA) is preparing to release a solicitation for the VA Server Enterprise Endpoint Security (VASEES) initiative, identified by solicitation number 36C10B25Q0203. This solicitation will be issued unrestricted under the NASA SEWP V Government-wide Acquisition Contract (GWAC) and falls under NAICS code 541519. The expected release date for this solicitation is projected for early to mid-August. The contracting office for this project is located in Eatontown, NJ, and inquiries can be directed to Contract Specialist Dana Seeler via email at dana.seeler@va.gov. This document serves as an official modification to a previous notice and indicates the agency's intent and expectations regarding the forthcoming solicitation for endpoint security services to enhance the VA's technical infrastructure.

The VASEES Service Level Agreements (SLA) outline performance expectations for a contractor providing services to the VA. Key SLAs include a two-hour engineering response time, 24/7 network monitoring with a 15-minute outage notification, and a commitment to 99.9% service availability. Should service availability fall below this threshold, the VA can request service credits proportional to the level of non-compliance. The contractor is required to monitor system load and utilization to ensure efficiency, with specific thresholds for CPU and memory usage. Support response times vary by severity level: critical issues demand a 30-minute response, serious problems require one hour, moderate issues four hours, and minimal requests one day. Performance levels must be validated within 30 days of contract award, including routine testing and reporting to maintain compliance. The document emphasizes accountability, outlining how service credits will be structured if SLAs are not met, reinforcing the contract's terms while ensuring continuous support for VA operations. The SLA serves as a critical element in government contracts, ensuring that contractors uphold their obligations and provide reliable service to federal clients.

The document outlines a Request for Proposal (RFP) for an Endpoint Protection Platform (EPP) designed for the Veterans Affairs (VA). It specifies general and operational requirements for a scalable, enterprise-grade host endpoint monitoring solution. Key features include FIPS 140-2 encryption for data security, modularity for component updates, and extensive application and network control capabilities. The solution must support various operating systems and integrate seamlessly with existing IT infrastructure, including SIEM and SOAR systems. Performance and operational metrics highlight the need for real-time threat analysis, malicious file containment, and data collection, ensuring minimal resource impact on host systems. Furthermore, the EPP solution should enable remote management capabilities, detailed reporting options, and adherence to federal compliance standards like NIST and 508 compliance. The focus on user access control, automated response to threats, and forensic investigation capabilities illustrates a comprehensive cybersecurity strategy, essential in protecting sensitive data and maintaining operational integrity across the VA's network. This RFP emphasizes the necessity for modern security solutions that can adapt to evolving threats while supporting the VA's mission to serve veterans effectively.

The Performance Work Statement (PWS) outlines the Department of Veterans Affairs' (VA) requirement for the VA Server Enterprise Endpoint Security (VASEES) system, designed to deliver comprehensive cybersecurity for up to 750,000 physical, virtual, and cloud-hosted clients. The contractor is responsible for deploying a Software as a Service (SaaS) solution, obtaining necessary authorizations, and maintaining high levels of security through compliance with federal guidelines, including FISMA and FedRAMP standards. The scope includes project management, staffing plans, training, and operational support. Key deliverables encompass a detailed project management plan, continuous monitoring and maintenance of the VASEES solution, and training for VA personnel. The contractor must ensure documentation, help desk scripts, and support infrastructure are in place to facilitate effective user interaction with the system. The contract spans an initial twelve-month period, extendable over four additional years, allowing for incremental asset licensing and scalability. This PWS reflects the VA’s commitment to enhancing cybersecurity practices while adhering to federal regulations, ensuring the safe management of sensitive information across all VA operations.

The Request for Information (RFI) for the VA Server Enterprise Endpoint Security (VASEES) is issued for planning purposes and does not obligate the government to procure any products or services. It invites vendors to provide insights regarding their capabilities specific to endpoint security solutions anticipated for the management of up to 750,000 devices. Interested vendors are instructed to submit detailed information within a 15-page limit, excluding marketing materials, and must include business size, NAICS codes, and a summary of their proposed solutions. Key areas of response include the scalability of technology, integration with existing cybersecurity systems, operational staffing plans to support 24/7 operations, and the readiness for FedRAMP certification. Vendors are also asked to outline pricing models and provide details about their experience with federal contracts. Responses are due by March 20, 2025, with submissions sent via email and marked for proprietary information. This RFI serves as a preparatory step for assessing market capabilities in achieving comprehensive endpoint protection for the VA's server enterprise.

The Request for Information (RFI) 36C10B25Q0203 pertains to the Department of Veterans Affairs' interest in exploring pricing structures associated with the VASEES initiative. Following a query about extending the closing date for the RFI, the response confirmed that the closing date remains set for Thursday, March 20, 2025. A significant inquiry regarding the expected format for pricing submissions indicated that the Department seeks an overview of the pricing structure rather than a detailed market research quote or precise cost estimation. This document serves as a communication tool to clarify details for potential respondents, ensuring their submissions align with the Department’s expectations and aiding in their market research efforts related to veterans’ services. The document reflects the structured communication typical in government RFPs, aiming to streamline the procurement process and ensure clarity for all stakeholders involved.