Web Application Firewall (WAF) and Content Delivery Network (CDN)

This Tender is invited by the Issuer. Overview The Department of Agriculture, Fisheries and Forestry is seeking information from the market on solutions capable of providing secure, scalable and centrally managed delivery and protection of internet-facing applications and services, through a Request for Information (RFI) on Web Application Firewall (WAF) and Content Delivery Network (CDN) capabilities. Purpose The Department's current and future operating environment requires a consistent approach to managing web application security, availability and performance across a diverse portfolio of externally accessible applications. The Department is seeking to better understand available market offerings that can assist in addressing these challenges. There is currently no approved project schedule or implementation date associated with this requirement. The information gathered through this RFI will be used to inform the Department's understanding of available market capabilities, potential solution options, delivery approaches and indicative costs, and may be used to support the planning and development of future procurement activities. About The users and their needs The primary users of the solution are the Department's digital service owners, platform administrators, cyber security personnel, and operational support teams responsible for the delivery, security and availability of internet-facing applications and services. These users require a solution that provides effective protection against sophisticated bot activity, automated attacks and other malicious web-based threats targeting the Department's externally accessible services. Users need the ability to apply preventative security controls consistently across multiple applications and environments through a centrally managed platform, reducing the need for individual application teams to implement and maintain bespoke security controls. Service owners require enhanced visibility into application traffic, threat activity, security events and policy effectiveness through comprehensive monitoring, reporting and management capabilities. This will enable more informed decision-making, improved governance and a stronger understanding of the security posture of their services. Operational and security teams require a solution that simplifies the administration and management of web application protection controls, reduces reliance on application-level mitigations, and supports rapid and consistent deployment of security policies across the Department's application portfolio. The solution should minimise operational overhead while maintaining a high level of protection, availability and performance. Ultimately, users are seeking a scalable, centrally managed solution that strengthens the security and resilience of internet-facing applications, improves operational efficiency, and provides a consistent approach to managing web application and automated traffic risks across the Department. Work already done The Department currently uses Azure-based WAF and CDN services to protect and deliver its internet-facing applications. Objectives The Department is seeking to understand available market offerings that can assist in addressing the following challenges: Protecting internet-facing applications from evolving cyber security threats, including malicious and automated traffic, web application attacks and denial-of-service activities Applying security controls consistently across multiple applications and environments without reliance on application-specific configurations or bespoke mitigations Reducing operational complexity associated with managing and maintaining security controls across individual applications Improving visibility of external traffic, application threats, security events and service performance through centralised monitoring, reporting and management capabilities Enhancing the availability, resilience and performance of externally facing services, particularly during periods of increased demand or malicious activity Supporting a scalable operating model that enables the onboarding and management of existing and future internet-facing applications and services Information Requested Through this RFI, the Department seeks information on WAF, CDN, and related application delivery and security capabilities that can provide centralised management, consistent policy enforcement, advanced threat protection and performance optimisation. Respondents are invited to outline how their solution addresses these challenges, including architecture, security capabilities, operational requirements, scalability, reporting functionality and implementation considerations. The Department seeks a solution that integrates with its existing Azure cloud environment and supports a straightforward migration from current WAF and gateway capabilities, with minimal disruption to services and operations. Respondents should outline their approach to integration, migration, and transition, including any dependencies, risks, effort estimates and tools available to support implementation. Respondents should describe how their solution addresses the Department's technical and business constraints, including any dependencies, assumptions, limitations or additional services required for implementation and operation. Contractor Requirements Technical/business constraints Integrates effectively with the Department's Microsoft Azure environment Supports deployment and management through Terraform Aligns with Australian Government security requirements and supports IRAP accreditation processes Meets the Department's data sovereignty obligations, including transparency regarding data storage, processing locations and support arrangements Integrates with existing operational and security capabilities, such as identity and access management, security monitoring, incident response and reporting processes Provides a scalable, centrally managed platform capable of supporting multiple internet-facing applications while minimising operational complexity and administrative overhead