2.2.1-70CTD026Q00000102_RFQ_ZTB RFO 8.4_SSJ_BNO_Zscaler_Redacted for SAM.pdf

OFFICE OF ACQUISITION MANAGEMENT

ICE Acquisition Manual 3008.4

FEDERAL SUPPLY SCHEDULE ORDERS

SOLE SOURCE JUSTIFICATION

ITEMS PECULIAR TO ONE MANUFACTURER [ORDERS OR BPAS]

J&A-26--0258

This acquisition is conducted under the authority of the Multiple-Award Schedule Program, 41 U.S.C.

152(3), Competitive Procedures, and 40 U.S.C. 501, Services for Executive Agencies, and Federal Acquisition Regulation (FAR) 8.401(b) (Class Deviation 25-200F

1) which follows the ordering procedures established by the General Services Administration (GSA) at GSAR 538.7104-4.

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Immigration and Customs Enforcement (ICE), Office of Acquisition Management (OAQ), on behalf of the Office of the Chief Information Officer (OCIO), Systems Engineering Division (SED), proposes to award an order pursuant to Revolutionary Far Overhaul (RFO) 8.401(b) and GSA Acquisition Regulation (GSAR) 538.7104-4, items peculiar to one manufacturer.

2. Nature and/or description of the item/service being procured and anticipated cost.

(a) Type of action: Firm-Fixed Price Blanket Purchase Agreement (BPA) Call Order

(b) Amount the current J&A is justifying:

(c) Brief Description: ICE/OAQ intends to limit the number of sources selected pursuant to RFO 8.401(b) and GSAR 538.7104-4 for the procurement of Zscaler brand-name Zero Trust Branch (ZTB) hardware and related implementation support for the ICE enterprise. The effort includes licenses, replacement of legacy network hardware, installation and configuration of ZTB devices, and integration with ICE’s existing Zscaler environment. ICE will issue a BPA Call under DHS Strategic Sourcing Vehicle (SSV) Enterprise Licenses (Carahsoft) Blanket Purchase Agreement (BPA) 70RTAC26A00000011 for this Zscaler procurement. This is a single award BPA with the proposed contractor listed below. It is also mandatory for use in accordance with DHS Directive 060-01.

Manufacturer:

Zscaler Inc.

120 Holger Way San Jose, CA 95134

Proposed Contractor / Authorized Distributor:

Carahsoft Technology Corporation 11493 Sunset Hills Road, Suite 100 Reston, Virginia 20190 GSA MAS Contract No. 47QSWA18D008F

BPA 70RTAC26A00000011

3. A description of supplies/services required to meet the agency’s need, including the estimated total value (base and all options).

1 FAR Class Deviation 25-20 is implemented as a result of Revolutionary FAR Overhaul, referred to as RFO, following Executive Order 14275, Restoring Common Sense to Federal Procurement. All citations in this document follow applicable DHS RFO Deviations therefore are referred to as RFO.

FEDERAL SUPPLY SCHEDULE ORDERS

The requirement is to provide hardware and related implementation support at a total estimated cost of These products will allow ICE OCIO to support secured network protection, and connectivity for agency systems and users. The requirement includes ZTB devices, associated hardware components, SD-WAN functionality, segmentation capabilities, and vendor support necessary to deploy, operate, and maintain the ZTB infrastructure. ICE’s existing Zscaler software licenses and enterprise capability will be used in conjunction with the procured ZTB hardware.

The solution must provide, at a minimum:

Integration with the existing cloud security platform and tenant architecture.

Centralized policy management consistent with current security policies.

Zero trust access controls for branch users, workloads, and applications.

Secure connectivity from branch environments to authorized applications and services.

Traffic inspection and enforcement using existing security controls where applicable.

Identity-aware and application-aware access enforcement.

Segmentation capabilities to reduce lateral movement risk.

Centralized logging, reporting, and operational visibility.

Compatibility with current DHS administrative, monitoring, and support processes.

Vendor support and lifecycle management for the capability.

A solution is required to accommodate the differing connectivity, capacity, availability, and deployment and requirements of ICE branch locations. The associated hardware capabilities and support are required to deploy, operate, maintain, and manage the infrastructure throughout the applicable ICE locations.

Period Time Unit Price Total Base 12 mos.

Current J&A:

4. Authority and supporting rationale.

ICE/OAQ intends to procure ZTB hardware and associated support on a brand name basis through the Multiple Award Schedule Program under the authority of 41 U.S.C. 152(3), Competitive Procedures, and 40 U.S.C. 501, Services for Executive Agencies. Only one manufacturer is capable of providing these Zscaler products because they are unique or highly specialized.

Rationale:

Pursuant to RFO FAR 8.401(b) and GSAR 538.7104-4, ICE has determined that the specified Zscaler brand-name hardware and support is essential to meet the Government’s requirements for interoperability, compatibility, and integration with ICE’s existing Zscaler enterprise environment.

ICE is currently operating an enterprise Zscaler environment and has already acquired the Zscaler software licenses and associated capabilities necessary to support the agency's Zero Trust architecture. This procurement is required to extend and operationalize the DHS Zscaler environment as an enterprise secure access capability. The action will support expanded user coverage, required licensing and capacity, configuration management, integration with DHS identity and security tools, policy enforcement, monitoring, reporting, and sustainment support. For end users, the procurement will enable more consistent, reliable, and secure access to approved internet, cloud, and internal resources, while improving protection against cyber threats and reducing access disruptions.

FEDERAL SUPPLY SCHEDULE ORDERS

Without this procurement, DHS may be unable to sustain or scale the Zscaler environment to meet enterprise demand. This could result in constrained user onboarding, reduced technical support, delayed policy updates, inconsistent access controls, degraded user experience, limited security visibility, and increased cybersecurity and mission risk. Failure to proceed may also delay zero trust and secure access modernization efforts and require less efficient workarounds or emergency support actions.

This acquisition is not intended to establish a new Zscaler software platform or replace the Zscaler licenses currently utilized by ICE.

This Zscaler ZTB expansion further increases ICE’s alignment with Executive Order 14028, Improving the Nation’s Cybersecurity, by supporting ZTA principles and enabling stronger access controls across the enterprise.

The DHS OCIO has instructed components to leverage the Enterprise License BPA to rapidly adopt secure cloud gateways and private access solutions, deprecate legacy Virtual Private Networks (VPNs), eliminating complex Wide Area Network (WAN) hardware, and improve the end user experience.

The DHS Enterprise License BPA provides the established procurement and technical framework for implementing the Department’s Zero Trust Network Access (ZTNA) strategy. ICE’s use of the BPA is consistent with the Department’s direction to leverage the enterprise Zscaler capability and provides a means to extend that capability to ICE locations.

The DHS Office of the OCIO Memorandum dated June 8, 2026, provides Department-wide guidance regarding implementation of Zero Trust Architecture and the use of the Enterprise License BPA.

Although other DHS enterprise vehicles or BPAs may provide ZTNA capabilities, ICE’s current requirement is not limited to obtaining ZTB hardware. ICE requires hardware and implementation support that provides branch connectivity, SD-WAN, segmentation, and integration with ICE’s existing Zscaler enterprise environment. The Zscaler ZTB solution provides these branch capabilities as an integrated component of the Zscaler environment already deployed and licensed by ICE. Market research was conducted to assess available ZTNA solutions, contract vehicles, reseller channels, and integrator support options capable of meeting ICE’s requirement. The review considered whether alternative commercial solutions or vehicles could provide comparable secure access capabilities and whether they could be modified to integrate with ICE’s existing Zscaler architecture, enterprise configurations, security policies, management processes, and operational environment.

The Government determined that an alternative ZTNA solution or vehicle would not, by itself, satisfy the requirement. Although other products may provide similar ZTNA functionality, modifying them to meet ICE’s operational requirement would require significant engineering, reconfiguration, integration, testing, migration planning, policy redevelopment, and retraining. These modifications would increase cost, schedule, cybersecurity, and mission risk, and could disrupt established secure access operations.

Accordingly, the selected approach is necessary to extend and operationalize ICE’s existing Zscaler environment, preserve continuity of operations, support current end-user access needs, and avoid the risks associated with transitioning to or modifying an alternative solution.

FEDERAL SUPPLY SCHEDULE ORDERS

The BPA is not, by itself, the basis for the brand-name restriction. The brand-name requirement is based on ICE's existing Zscaler enterprise environment and the Government's specific need for hardware that can operate as an integrated component of that environment.

Specific reasons for the brand-name requirement include:

a. Integration with Existing Zscaler Environment

DHS has existing Zscaler services, configurations, policies, tenant structures, administrative roles, logging integrations, and operational workflows. Zscaler ZTB is designed to operate within the existing Zscaler ecosystem. This allows DHS to extend existing investments and maintain a consistent zero trust architecture across remote users, applications, cloud environments, and branch locations.

Market research determined that non-Zscaler solutions cannot be modified to meet ICE’s minimum requirement without replacing or reengineering core elements of the existing operational environment. Any such modification would require a separate architecture, separate identity and logging integrations, new policy development, new security monitoring workflows, operational retraining, testing, migration planning, and changes to established support processes. These activities would not constitute minor modifications to an otherwise compliant solution. They would amount to implementing a different ZTNA environment and would fail to meet ICE’s requirement for continuity with the existing Zscaler architecture, configurations, policies, management processes, and operational workflows.

Therefore, alternative ZTNA solutions were determined not capable of satisfying the requirement through modification. The procurement must support the existing Zscaler environment to avoid disruption to secure access operations and to meet ICE’s operational, cybersecurity, and mission needs within the required timeframe.

b. Consistent Security Policy Enforcement

The Department requires consistent enforcement of security policies across branch locations and existing Zscaler-protected environments. Zscaler ZTB enables centralized and consistent policy management within the existing Zscaler platform.

Using another vendor would require policy translation or duplication across platforms. Market research determined that similar non-Zscaler ZTNA products do not meet, and cannot be modified to meet, ICE’s minimum requirements. ICE requires a solution that extends and operationalizes its existing Zscaler architecture, configurations, policies, identity integrations, logging integrations, and operational monitoring workflows. Similar products are not capable of functioning as extensions of ICE’s deployed Zscaler environment and cannot be modified to do so without replacing or reengineering the existing architecture, which is outside the requirement. Accordingly, similar products were determined incapable of satisfying the requirement, including through modification.

c. Operational Continuity

DHS personnel and support teams already use Zscaler administrative tools, dashboards, reporting, alerting, support processes, and troubleshooting workflows. Zscaler ZTB allows DHS to leverage existing operational knowledge and procedures.

FEDERAL SUPPLY SCHEDULE ORDERS

Introducing another branch security platform would require additional staff training, new operational procedures, new escalation paths, and separate monitoring processes. This would increase lifecycle support costs and could negatively affect incident response timelines.

d. Logging, Monitoring, and Incident Response Alignment

DHS requires branch security telemetry to align with current security monitoring and incident response processes. Zscaler ZTB supports centralized visibility and integration with existing Zscaler logging and reporting structures.

A different product would require new logging formats, new connectors, new alert logic, and additional validation to ensure logs can be normalized and used effectively by cybersecurity teams.

e. Reduced Implementation Risk

Zscaler ZTB reduces technical and schedule risk because it builds on the Department’s existing Zscaler architecture. The use of the same vendor platform supports faster deployment, lower integration risk, and simplified sustainment.

A different solution would require additional engineering analysis, proof-of-concept testing, configuration development, cybersecurity review, authorization package updates, and operational acceptance testing.

f. Avoidance of Duplicative Capabilities and Costs

A non-Zscaler solution would duplicate capabilities already available through DHS’s existing Zscaler investment, including policy management, traffic inspection, zero trust access enforcement, reporting, administration, and support.

The acquisition of Zscaler ZTB avoids unnecessary duplication and supports efficient use of existing licensing, architecture, skills, and operational processes.

Based on general market knowledge, there are multiple vendors that provide secure access service edge, SASE, software-defined wide area network, SD-WAN, secure service edge, SSE, and branch security capabilities. Potential vendors may include providers of firewall, SD-WAN, SASE, SSE, and zero trust network access technologies.

However, the Government’s requirement is not merely for generic branch security or SD-WAN functionality. The requirement is to extend the Department’s existing Zscaler zero trust architecture to branch environments while preserving centralized policy enforcement, existing Zscaler integration, logging, operational workflows, and administrative continuity.

Use of another manufacturer's hardware would not constitute a simple substitution of one physical appliance for another. ICE would first need to determine whether the alternate hardware could provide the required branch connectivity, SD-WAN, segmentation, management, and deployment capabilities while interoperating with the existing Zscaler environment. The Government would also need to assess and potentially redesign existing network configurations, routing, security policies, management interfaces, logging, monitoring, identity integrations, and operational procedures.

FEDERAL SUPPLY SCHEDULE ORDERS

An alternative platform would require additional engineering, integration, testing, configuration, validation, training, and operational support before deployment at ICE locations. The Government would also potentially be required to operate and maintain multiple branch networking architectures rather than a standardized enterprise architecture. These activities would increase implementation complexity and transition risk and could delay deployment of the required branch infrastructure.

Standardizing on the existing Zscaler platform supports:

Unified security policy administration.

Consistent access control decisions.

Reduced operational complexity.

Improved monitoring and incident response.

Reuse of existing staff expertise and processes.

Lower integration and lifecycle sustainment burden.

Zscaler ZTB hardware is designed to operate as an integrated component of the Zscaler environment already deployed and supported by ICE. ICE uses the existing Zscaler environment to provide secure, policy-based access to approved internet, cloud-based, and internal resources used by personnel to perform official duties. The environment supports identity-based access, traffic inspection, web and application policy enforcement, threat protection, logging, monitoring, and visibility into user activity across headquarters, field, branch, and remote operating environments.

Acquisition of the Zscaler ZTB solution and hardware will allow ICE to leverage its existing Zscaler investment, enterprise configurations, security policies, identity and logging integrations, operational knowledge, management processes, and established support structure while extending the existing architecture to geographically distributed branch locations. Maintaining a common Zscaler hardware and software architecture is necessary to standardize deployment, configuration, management, troubleshooting, monitoring, and security controls across those locations.

Without continued use and extension of the Zscaler environment, ICE personnel could experience degraded or interrupted access to mission applications, collaboration tools, cloud services, web-based resources, and authorized internal systems needed for daily operational, administrative, investigative, legal, financial, human resources, information technology, and mission-support functions. While limited workarounds or legacy access methods may allow some activities to continue, they would not provide the same enterprise secure access capability, centralized policy enforcement, identity integration, logging, monitoring, or operational continuity. A prolonged inability to leverage the Zscaler environment would impair ICE’s ability to securely support personnel across geographically distributed locations and would increase cybersecurity, operational, and mission risk.

Market research has determined that similar non-Zscaler products do not meet, and cannot be modified to meet, ICE’s minimum requirements. Similar products are not designed to operate as integrated components of ICE’s deployed Zscaler architecture and cannot provide native compatibility, interoperability, and operational continuity with ICE’s existing configurations, policies, identity integrations, logging integrations, management processes, and monitoring workflows.

Modification of a non-Zscaler product would require replacement or reengineering of the existing architecture rather than extension of the deployed Zscaler environment, which is outside the Government’s requirement.

Accordingly, the requirement for Zscaler ZTB hardware is based on ICE’s specific technical and operational need to extend its existing Zscaler environment to branch locations, not on a general

FEDERAL SUPPLY SCHEDULE ORDERS

preference for Zscaler or its availability through the DHS Enterprise License BPA. For these reasons, Zscaler ZTB hardware and solution are required to meet ICE’s current technical and operational requirements and support implementation of DHS and ICE Zero Trust Architecture objectives.

5. Technical/Requirements Personnel Certification.

I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for this justification, are accurate and complete.

Technical Representative/COR Date

6. Contracting Officer Certification

Contracting Officer Date

7. Approval.

Procuring Activity Advocate for Competition Date