JEFO_CTMDINS.pdf

“Source Selection Information – see FAR 2.101 and

3.104”

1. Identification of the agency and contracting activity

i. Federal Agency and Contracting Activity.

Department of Health and Human Services National Institute of Health (NIH)

ii. Sponsoring Organization.

Indian Health Service (IHS)

Office of Information Technology (OIT)

Department of Information Security (DIS)

iii. Contracting Officer’s Representative (COR) Information.

Solomon Wilson

DIS Project Manager

Indian Health Service (IHS) Division of Information Security (DIS)

Solomon.Wilson@ihs.gov

301-956-5879

iv. Contracting Activity

Kelly Lael, Contracting Officer NIH/OLAO/NITAAC

11545 Rockville Pike, Floor 10

Rockville, MD 20852 kelly.lael@nih.gov

301-347-8156

2. Nature and/or description of the action being approved.

i. Acquisition purpose and objectives.

The purpose of this acquisition is for IHS to become compliant with recent Executive Order

14028 On Improving the Nation’s Cybersecurity and the corresponding Office of Management

Budget (OMB) Memorandums M-21-31 Improving the Federal Government’s Investigative and Remediation Capabilities, M-22-09 Moving the U.S. Government Toward Zero Trust

Cybersecurity Principles, and M-24-04 Fiscal Year 2024 Guidance on Federal Information

Security and Privacy. In light of the rapidly evolving cybersecurity landscape and the specific needs of the healthcare sector, it is imperative to fulfill and maintaining zero trust principles.

DIS will maintain its security framework through the purchase of additional commercial-off-the-shelf (COTS) commodity enabled services and technologies as defined below. This request is for a one-time purchase of COTS items to meet federal guidance and reporting requirements issued after this delivery order was awarded. Only the proposed items can integrate with the existing

IHS infrastructure which is supported by Palo Alto commercial items and services. Only the current contract holder is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized. These items and their implementation allows IHS/OIT to meet the mandates and deadlines defined in M-24-04. The items described below will be added to option period one of delivery order

HHSN316201500052W 75N98123F00001.

Justification for Exception to Fair Opportunity mailto:Solomon.Wilson@ihs.gov mailto:kelly.lael@nih.gov

1) ADEM or Autonomous Digital Experience Manager, is a network monitoring software and dashboard that will report the digital experience of the IHS 22,500 remote users and pinpoint network issues. Its core purpose is to swiftly detect and address any network issues, ensuring a smooth and uninterrupted digital experience for all users.

In use, the IHS ADEM solution provides:

a. Enhanced user experience and operational efficiency, this allows for real-time monitoring and swift issue resolution minimize downtime and increase productivity.

b. Compliance for the mandatory requirements for continuous network monitoring and performance assessment under M-21-31, M-22-09, EO-14028, and CISA 2.0.

2) Data Leak Prevention (DLP) subscription. DLP is a service and software license specifically designed to oversee and uphold the Zero Trust Architecture (ZTA) Pillar for

Data & Application for a user base of 22,500 remote users.

In use, the HIS DLP solution provides:

a. Data security which ensures sensitive healthcare data is protected from unauthorized access and leakage, aligning with HIPAA and other regulatory requirements.

b. Zero Trust enablement. DLP supports strict access controls and data governance, vital components of ZTA, ensuring only authorized users access critical data.

c. Compliance via providing advanced data leak prevention measures which are essential for meeting the M-21-31 Data & Application Pillar requirements.

3) Extended Security Orchestration Automation & Response (XSOAR). XSOAR is an expansion to an existing software license to allow 100 additional privacy security analysts to develop, manage, and enhance playbooks for privacy security incidents.

In use, the IHS XSOAR provides:

a. Scalability. This enables the IHS security team to efficiently manage the increasing volume of security events, which is critical for compliance with CISA 2.0 and EO-

14028.

b. Enhanced response. This automates and streamlines incident response workflows, reducing the time to detect and mitigate threats.

c. Compliance with federal cybersecurity mandates by ensuring prompt and effective security incident management with coverage.

4) Software-defined wide area network (SD-WAN) professional services (SD-WAN PS) includes assisting with the planning and execution of the SD-WAN implementation.

Contractor consultants remotely configure and deploy Prisma SD-WAN functionality for up to five (5) sites deployed in any combination of hubs and branches. Support includes knowledge transfer to IHS team, as is and as-built documentation upon completion of the engagement.

In use, the IHS SD-WAN PS provides:

a. Optimized deployment: Accelerates the deployment of SD-WAN solutions, delivering cost-efficient, secure, and reliable network architectures. This deployment provides protection on day-one.

b. Network performance: Ensures optimal performance and future readiness of our network infrastructure, which is vital to supporting remote healthcare services.

c. Compliance for IHS security and with the above OMB requirements, ensuring a resilient and secure communications framework.

5) ADEM/DLP professional services (ADEM/DLP PS) includes contractor support provides engineers to provide expert guidance and support for the ADEM/DLP deployment for IHS.

In use, the IHS ADEM/DLP PS provides:

a. Tailored solutions. Contractor support delivers customized ADEM and DLP implementations, ensuring they meet IHS healthcare security needs.

b. Compliance. This solution integrates monitoring and data protection solutions to ensure compliance with M-21-31, M-22-09, M-24-04, EO-14028, and CISA 2.0.

6) Strata Logging Service (SLS) is a cloud-delivered logging and analysis service simplifies

IHS access to logs and improves detection and remediation times.

In use, the IHS SLS provides:

a. Simplified operations with streamlined log management and analytics, enhancing our ability to swiftly detect and respond to threats.

b. Compliance. This solution meets the requirements of M-21-31, M-22-09, EO-

14028, and CISA 2.0 for log management and incident detection.

c. Operational visibility. The solution provides comprehensive visibility into network events, which is vital for maintaining a secure and compliant environment.

7) Splunk software as a service (SaaS) storage. Although this brand name item is separate from the Palo Alto products defined in this justification, there is also a correlating need for this additional storage to support the new Palo Alto work. This addresses the Splunk storage shortfalls. These shortfalls are due to the U.S. National Archives and Records

Administration (NARA) retention requirements of the data ingested from the IHS security tools (i.e., Palo Alto). The name brand storage is part of the solution implemented. This is required because there is an integration requirement for the SaaS solution within the IHS architecture. To be compliant with NARA records retention, IHS requires 3 Petabytes of storage.

Splunk SaaS storage will capture and analyze data for M-21-31 logging requirements, which include Zero Trust Architecture (ZTA) enablement. This offers data analytics and storage capabilities for maintaining security and compliance. M-21-31, M-22-09 and M-24-

04 requires us to store the information (Splunk) that is captured from the Palo Alto devices and products we are implementing. M-21-31 plays a significant role meeting the M-22-09, M-23-01, M-24-04 and EO-14028 compliance objectives for a complete transparency.

Splunk supports Palo Alto Network Logging in a Zero Trust capacity through continuous monitoring. Palo Alto firewall logs and user and device behavior analytics and incident response.

8) Deploy the existing Palo Alto firewall infrastructure on IHS to support SD-WAN, enforce segmentation policies, and analyze real-time security events.

In use, the IHS Splunk SaaS storage provides:

a. Enhanced segmentation. This will strengthen IHS security posture by isolating sensitive data and applications, a core tenet of ZTA.

b. Threat detection. This improves threat detection and incident response capabilities, ensuring regulatory compliance and data protection.

c. Compliance. This will ensure meeting M-21-31 requirements and healthcare modernization requirements by providing advanced segmentation and monitoring capabilities.

By adopting these comprehensive measures, IHS will be well-positioned to meet today's healthcare landscape's stringent security requirements and operational demands.

Implementing ZTA and associated services ensures that we comply with federal mandates like M-21-31, M-22-09, M-24-04, EO-14028, and CISA 2.0 and significantly improve our overall security posture and operational efficiency.

The original delivery order has a base period of performance of September 18, 2023 -

September 17, 2024 and four 12 month option periods. This delivery order was initially issued with a brand name justification and fair opportunity to eligible value added resellers. It was awarded to CMA TECHNOLOGY, INC in the total amount of $33,479,988.24.

The following are being added as additional work to the existing delivery order:

Description Part Number Qty

Autonomous Digital Experience Manager PAN-PRISMA-ACCESS-MU-DEM 22,500

Data Leak Prevention Subscription PAN-PRISMA-ACCESS-MU-DLP 22,500

XSOAR – Additional Analyst Seats PAN-XSOAR-FULL-USER 100

SDWAN Professional Services (Installation

Services)

PAN-CONSULT-SDWAN 1

ADEM/DLP Professional Services (Expert

Engineer)

PAN-CONSULT-ADEM-DLP 1

Strata Logging Service (SLS) PAN-CDL-TB-USG 130TB 1

Splunk SaaS Storage (3 Petabytes) Storage-SE-S-SVC-FED-STOR-TU 6000

Project background. The Indian Health Service (IHS) develops and supports several comprehensive integrated health information systems. These systems support a broad range of clinical and business functions at IHS, Tribal and Urban (I/T/U) hospitals and clinics across the country. IHS requires the security to protect these applications i.e., Resource and Patient

Management System (RPMS), National Patient Information Reporting System (NPIRS), Electronic

Dental Records (EDR) and other related medical and IT devices that support IHS mission. These systems are derived from the same legacy security architecture and over the years shared many of the same infrastructure and healthcare networks. It runs hundreds of critical patient and business applications, which align payers, providers, and patients around a common plan of care. The IHS must now meet the mandates of OMB and EO to protect Federal and Public healthcare information.

3. Description of the supplies or services required to meet the agency’s needs (including the estimated value).

i. Project title. FY 24 FISMA Compliance for Continue Threat Mitigation –

Device Identification and Network Segmentation and IR Enhancement.

ii. Project description. The contractor shall provide license(s), maintenance, software security fixes, training, and technical assistance for IHS’s Cybersecurity

Modernization project for Continue Threat Mitigation – Device Identification and

Network Segmentation and Incident Response (IR) Expansion.

• Requirement type.

❑ Research & development (R&D) ❑ R & D support services

❑ Support services (non-R&D)

❑ Supplies/equipment

Information technology (IT)

❑ Construction

❑ Architect-engineer (A & E) services

❑ Design-build

❑ Other (specify):

• Type of action.

❑ New requirement

❑ Follow-on

Other (specify): Justification to exclude fair opportunity

• Proposed contract/order type.

Firm-fixed-price

❑ Other fixed-price (specify, e.g., fixed-price award-fee, fixed-price incentive-fee):

❑ Cost-plus-fixed-fee

❑ Other cost reimbursement (specify, e.g., cost-plus-award-fee, cost-plus-incentive-fee):

❑ Time and materials

❑ Indefinite delivery (specify whether indefinite quantity, definite quantity, or requirements):

❑ Other (specify):

❑ Completion Form

❑ Term form

● Acquisition identification number. IAA with NITAAC

iii. Total estimated dollar value and performance/delivery period.

Summary | Period of performance: FY24

Period of Performance Start Date End Date Total:

Option period one (new work)

September 17 2024 September 18 2025 $ 9,855,648.00

Total: $ 9,855,648.00

4. Identification of the exception to fair opportunity. The supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

i. Acquisition Authority

FAR 16.505(b)(2)(i)(B) Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

ii. Demonstration of the proposed contractor(s) unique qualifications to provide the required supply or service.

i. Name and address of the proposed contractor(s).

CMA Technology, Inc.

8075 Leesburg Pike, Suite 740

Vienna, VA 22182

ii. Nature of the acquisition and proposed unique qualifications of the contractor(s).

Recently, IHS acquired all the network equipment to begin the modernization of its network infrastructure. To ensure a seamless modernization process and avoid significant risk the new equipment, software license and services must be compatible with the existing government-owned equipment. Replacing the government-owned equipment is not feasible at this time, to do so IHS estimates it would double the up-front expense and eliminate the benefits of the already owned items. It would also cause delays for the IHS in meeting the compliance requirements set by the

OMB and EO mandates. Therefore, the chosen solution can safeguard IHS's recent investment’s, offer an immediate resolution and minimize any potential disruptions to services.

The cybersecurity risks within healthcare systems demand immediate attention and prompt action to ensure the proper protection required by patients and organizations exchanging healthcare data. Ignoring the need to modernize security protocols could result in a patient backlash, lowered brand reputation and fines. Therefore, IHS must take affirmative steps to protect patients and confidential information by adopting modernized cybersecurity solutions.

IHS hosts a variety of healthcare systems that are also quite extensive and would result in the same loss of functionality to the downstream data workflow such as congressional reporting.

These downstream systems support and meet mandates of other government agencies; Food and

Drug Administration (FDA), the Center for Disease Control (CDC), and the Content

Management System (CMS). New solution implementation could not easily be implemented immediately without disrupting patient care. Therefore, the purchase of the solution and services to support the existing network and data hosted with IHS environment requires a solution that can be implemented most efficiently in a less disrupted. The required solution expands IHS

OIT’s firewall capacity to keep pace with the ongoing growth in IHS network traffic. This acquisition includes brand name specifications that are essential to the government’s requirements.

CMA Technologies is an authorized reseller of Palo Alto products. The current delivery order is being used to perform upgrades of the Palo Alto products supporting the IHS infrastructure. Under this delivery order CMA provides COTS Palo Alto subscriptions and subscription support services. This means the contractor supports IHS with subject matter expert support on multiple cybersecurity projects, implementation and deployments of the

Palo Alto items purchased under this delivery order. Consequently, to solicit this new work outside of this delivery order could result in a duplication of effort. For instance multiple support contractors would need access to the same parts of the IHS systems and IHS technical experts. It would require IHS to duplicate its own efforts and oversight by segregating sections of the projects to different support contractors. In addition to duplication of effort, it could also potentially delay the agency’s schedule through a new solicitation. With duplicative oversight and delayed support, this could potentially leave the

IHS system vulnerable to high risk cyber threats. With CMA's authorized Palo Alto reseller status, having the subject matter experts on hand, access to IHS systems as well as experience in the current and ongoing delivery order projects, they are the only one capable of providing the level of quality required because the supplies and services ordered are highly specialized. Conclusively, CMA is the only one who can integrate the items and perform this new work without adding in new performance risks to IHS.

5. Determination by the Contracting Officer that the Anticipated Cost to be Fair and

Reasonable.

The Office of Information Technology calculated the IGCE based on historical pricing. The modification to the delivery order will include a price comparison to publicly available published prices, current and historical pricing on the CIO-CS GWAC. NITAAC is designated as a federal

Executive Agent authorized by OMB to administer three best in class GWACs. The NITAAC contracting office has established GWAC rates and pricing that have been determined to be fair and reasonable. The price breakdown of the licensing is based on cost per pricing unit. The number of license units are determined from a formula that is derived on hospital bed counts and average annual visits.

Although the brand name products price is set by the manufacturer and no competition is available for this requirement, the contracting officer will also review publicly available prices paid for these products and compare them against other similar COTS products for a fair and reasonable determination.

6. Any other facts Supporting the Justification.

Under 16.505(a)(4)(i) brand-name item peculiar to one manufacturer, the FAR requires that

”…[b]rand-name specifications shall not be used unless the particular brand-name, product, or feature is essential to the Government’s requirements and market research indicates other companies’ similar products, or products lacking the particular feature, do not meet, or cannot be modified to meet, the agency’s needs.” This portion of the justification covers this FAR requirement.

Palo Alto products fulfill the integration needs within the IHS infrastructure. Other market place competitors’ similar products do not meet the agency's needs and cannot be modified to meet them. Palo Alto provides scalability and performance with the ability to support the IHS network infrastructure's size and complexity while maintaining optimal performance.

Based on the market research, no other competitor commercial item offered a complete solution that aligns with all IHS requirements like Palo Alto does. While some competitor commercial items excelled in specific areas (e.g., McAfee in DLP, Forcepoint in access control), their limitations in other areas (e.g., UBM, threat detection) were found to not fully meet the needs of IHS security requirements.

Only the required brand name items can complement the infrastructure in place and be compatible with the existing IHS/OIT Palo Alto firewall infrastructure. Only Palo Alto solutions can be integrated into enterprise firewall clusters IHS has acquired and upgraded. This integration allows

IHS to incorporate Zero-Trust Framework into its infrastructure as required by OMB and executive orders.

7. Statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

IHS anticipates requesting follow-on procurements as long as the Palo Alto equipment and software is a part of our cybersecurity network infrastructure. While the program will continue to support existing equipment, IHS will also continue to assess the market for better solutions to its needs to meet future requirements, new technologies available, and future policies put in place.

FOR