# Zero Trust Application Realtime Protection (ZARP) (VA-25-00093376) Canonical: https://abierto.us/opportunities/36c10b25q0429 - Solicitation number: 36C10B25Q0429 - Notice type: Sources sought - Status: Closed. Deadline was July 16, 2025 at 12:00 PM EDT - Department: Department of Veterans Affairs - Contracting office: Technology Acquisition Center NJ (36C10B) - NAICS: 541519 Other Computer Related Services - Product or service code: DJ01 Support services focused on supporting security policies/controls, processes, measuring compliance of relevant legal/compliance requirements, to include Section 508, and responding to security breaches. Also provides support for IT Security systems providing Continuous Diagnostics and Mitigation (CDM) for real-time Cyber Security and protection such as vulnerability scanning, managing firewalls, intrusion prevention systems, and security information and event management (SIEM). Includes Disaster Recovery (DR) services to support DR policy, process and means, dedicated failover facilities and perform DR testing. - Set-aside: Service-disabled veteran-owned small business set-aside - First posted: July 8, 2025 - Last posted: September 16, 2025 - SAM.gov: https://sam.gov/workspace/contract/opp/7a466cbe732c49cb89ac9a53fcc1fab9/view ## Description **QUESTION:** Can you list the number of applications and break out how they are hosted? Interested in the number of container nodes, VMs, Serverless functions, etc. ANSWER: VA does not publish its application inventory at the market-research (RFI) stage. The exact number of applications and their hosting breakdown across on-premises data centers, VA Enterprise Cloud (AWS GovCloud US & Azure Government), and other environments will be provided to the selected vendor during post-award discovery and onboarding. **QUESTION:** Could the Government clarify whether Elastic SIEM integration is a requirement or if Splunk-only integration would be sufficient? **ANSWER:** Splunk-only Integration is sufficient QUESTION: Are there specific Splunk configurations or deployment models (cloud, on-premises, or hybrid) that the solution must support? **ANSWER:** The ZARP solution must cleanly support on-prem, cloud, and hybrid Splunk ingestion. **QUESTION:** Do you require SPUNK pricing in the ROM? **ANSWER:** **No QUESTION:** **SOAR Platforms (Swimlane):** Are there particular Swimlane integrations or workflows that the solution should accommodate to align with VA s current SOAR environment? **ANSWER:** At this stage we are not releasing VA-specific Swimlane playbooks or connector details. **QUESTION:** Which IAM systems are deployed within VA (e.g., Microsoft Azure AD, Okta, Ping Identity), and are there specific protocols (SAML, OAuth, OpenID Connect) required for integration? **ANSWER:** The VA uses multiple IAM services in a hybrid on-prem / cloud environment. More details will be furnished to the selected vendor during post-award discovery and onboarding. **QUESTION:** Given the use of Tenable for vulnerability management, are there specific integration requirements or use cases VA expects? Additionally, could VA identify CI/CD platforms in use (e.g., Jenkins, GitLab, Azure DevOps) that the solution should integrate with? **ANSWER:** VA uses several CI/CD pipelines.  Pipeline details are sensitive and will be shared only with the awardee under post-award security procedures. **QUESTION:** To provide a meaningful Rough Order of Magnitude (ROM) for the ZARP RFI, could the government provide approximate counts of workloads (VMs, containers, serverless functions) and anticipated data ingestion volumes for SIEM/SOAR integration? **ANSWER:** The requested information is not available QUESTION: Please clarify which Prisma Cloud modules (e.g., WAAS, CWPP, CSPM) VA expects vendors to include. **ANSWER:** **WAAS & CWPP QUESTION:** For scoping the number of VA workloads, how many on-premise container hosts will the solution need to support? **ANSWER:** The requested information is not available QUESTION: For scoping the number of VA workloads, how many K8 worker nodes will the solution need to support? **ANSWER:** The requested information is not available QUESTION: For scoping the number of VA workloads, how many serverless containers (AWS-Fargate / Azure ACI) will the solution need to support? **ANSWER:** The requested information is not available QUESTION: Can the VA confirm the solution must be capable of Runtime Application Self Protection (RASP)? **ANSWER:** Yes, the solutions must be capable of Runtime Application Self Protection QUESTION: Will the proposed zero trust solution require traffic visibility and enforcement aspects of ZTS Zero Trust Segmentation (or micro-segmentation), or will it be primarily based on North-South subnet-based enforcement? **ANSWER:** This RFI covers runtime-application and workload protection (ZARP). Network-level Zero Trust Segmentation (micro-segmentation) is handled by separate VA controls. The solution must inspect and enforce at Layer 7 for both North-South traffic (ingress/egress) and East-West traffic that remains within a subnet or host. Detailed integration points with VA s ZTS environment will be defined during post-award discovery. **QUESTION:** What is the scope of number of locations, workloads, applications as part of this solicitation or any other details you can provide that would be helpful for vendors? **ANSWER:** This information is not available QUESTION: Is the request for this new solution replacing existing technology and what is the existing solution today? **ANSWER:** There is no existing solution QUESTION: Is the VA using any segmentation solutions today within this environment and what is the technology being used? **ANSWER:** The specific vendors, products, and policy schemas are considered sensitive architecture details and will be disclosed only to the awardee under post-award security procedures. **QUESTION:** What GWACs is the VA currently considering for this procurement? Is GSA VETS 2 being considered? **ANSWER:** To be determined. The contract vehicle will be determined based on the responses received from the RFI. Please provide any existing contract vehicles per RFI Submittal Information paragraph 3(g). ## Publications - July 8, 2025: Sources sought, due July 16, 2025 at 12:00 PM EDT. Notice 10e1af61beec4aa5b61a6a7df1e31bc6. https://sam.gov/workspace/contract/opp/10e1af61beec4aa5b61a6a7df1e31bc6/view - July 14, 2025: Sources sought, due July 16, 2025 at 12:00 PM EDT. Notice 689132701f7541739923ed6f0da40984. https://sam.gov/workspace/contract/opp/689132701f7541739923ed6f0da40984/view - September 16, 2025: Sources sought, due September 30, 2025 at 12:00 PM EDT. Notice 18f1eed350274df5b7b52038e4f19ba8. https://sam.gov/workspace/contract/opp/18f1eed350274df5b7b52038e4f19ba8/view - September 16, 2025: Sources sought, due July 16, 2025 at 12:00 PM EDT. Notice 7a466cbe732c49cb89ac9a53fcc1fab9. https://sam.gov/workspace/contract/opp/7a466cbe732c49cb89ac9a53fcc1fab9/view ## Points of contact - Michael Berberich, Contract Specialist, michael.berberich@va.gov --- Source: SAM.gov Contract Opportunities bulk extract. Confirm deadlines on SAM.gov before responding. Cite https://abierto.us/opportunities/36c10b25q0429.