DA10--VA-26-00029054 - Data Loss Prevention (DLP) Infrastructure Solution - New Requirement

The Department of Veterans Affairs, through its Technology Acquisition Center in Eatontown, New Jersey, is soliciting proposals under solicitation number 36C10B26Q0418 for a Data Loss Prevention (DLP) Infrastructure Solution, structured as a Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside under NAICS code 541519. The contract calls for the implementation of a comprehensive Data Access Governance (DAG) platform to automate the discovery, classification, labeling, and policy enforcement of sensitive data across VA enterprise systems. Key requirements include compliance with federal standards such as HIPAA, PCI DSS, NIST, FedRAMP Moderate, Section 508, SOC 2/3, ISO, and NIAP Common Criteria, as well as adherence to VA's Zero Trust Architecture and Trusted Internet Connections 3.0. The solution must support identity security, real-time threat detection, cloud misconfiguration management, third-party application risk assessment, and AI systems that comply with Executive Order 14319 and OMB M-26-04, ensuring truthful, non-hallucinating outputs aligned with the VA Trustworthy AI Framework. Deliverables include a Statement of Attestation for AI use, Model Cards, Accessibility Conformance Reports, a Contractor Project Management Plan, training materials, and a Compliance Matrix confirming adherence to all specifications. The contract includes a 12-month base period with four additional 12-month option periods and one optional task for up to ten Enterprise Agreements related to DAG platform administration. Performance will be centered at the VA Technology Acquisition Center in Eatontown, NJ, with possible delivery to multiple VA sites coordinated through designated points of contact. All shipments must be labeled with the VA IFCAP Purchase Order number and sequential container identifiers, though no packaging, preservation, or barcoding standards beyond basic labeling are mandated. Proposals must be submitted electronically to Kevin Andujar, Contract Specialist, by July 1, 2026, at 10:00 AM Eastern Time, and must include a Bill of Materials, completed Schedule B price model spreadsheet, Compliance Matrix, Product Description, and optionally, a Transition Proposal if proposing an alternative to Varonis. While no actual pricing data is provided in the solicitation, offerors are required to submit detailed cost structures. Evaluation will focus on technical merit, risk mitigation, and regulatory compliance, with no indication of a Lowest Price Technically Acceptable approach