NNG15SD21B-045.pdf

LogRhythm Annual Maintenance Control Number: TAC-18-48581

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Acquisition Operations Technology Acquisition Center 1701 Directors Blvd. Suite 600 Austin, TX 78744

2. Description of Action: This proposed action is for a firm-fixed-price task order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name LogRhythm annual software maintenance.

3. Description of Supplies or Services: The VA Office of Information & Technology Enterprise Messaging & Collaboration Services (EMCS) Enterprise Core Services (ECS) Personal Identity Verification (PIV) Program has a requirement to provide maintenance subscription services licenses for VA-owned LogRhythm software. The renewal of LogRhythm support will allow VA to continue to receive vendor-supplied software updates and releases and maintain helpdesk access to the LogRhythm support team. Existing LogRhythm investment includes existing ownership of two LogRhythm appliances, which include hardware and software, and 200 LogRhythm System Monitor Pro agents. The current PIV LogRhythm support contract is set to expire on March 31, 2018. VA requires these services to ensure that the software remains operational with no break in support. The LogRhythm infrastructure is utilized to collect, archive, analyze log files from hosts and software in the PIV environment and generate status alerts and reports as needed. LogRhythm is used to achieve file integrity management and environment monitoring in order to maintain high availability of log files. LogRhythm aids in PIV system failure detection and recovery as well as in-service utilization and capacity planning. These essential services are mandated in the PIV Information System Security Program and PIV Disaster Recovery Plan. The period of performance for the order will be a 12-month base period beginning April 1, 2018 through March 31, 2019, with one 12-month option period.

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on the market research, as described in section 8 of this justification, it was determined that limited competition is available among resellers of LogRhythm annual software maintenance. LogRhythm is a proprietary software product; therefore no other software maintenance provider has the proprietary technical data to perform the necessary software support services.

Specifically, the current system and software communicates through a source code that is based on LogRhythm proprietary data. No other software can provide this communication capability without this source code. No other brand name software is able to maintain support for the currently fielded LogRhythm nor will any other brand name software be interoperable or compatible with the currently fielded LogRhythm software unless the existing software is completely replaced. A move to an alternative brand name would require all new software rather than the renewal of the current software maintenance and support services. Switching to new product would result in a substantial duplication of cost that would not be recovered through competition.

Additionally, substantial delays would be incurred of these critical services. The Government does not possess the proprietary technical data nor has access to LogRhythm proprietary software replacement for LogRhythm annual maintenance services. Based on the market research conducted by the Government’s technical experts it has been determined that only LogRythm or its resellers have the required access to the source code and other proprietary data necessary in order for the current infrastructure to run properly. Without this proprietary technical data or software, no source has the ability to provide LogRhythm maintenance services. The proprietary data allows access to the fundamental elements of the software that is essential for software updates, patches, bug fixes, security and version control. The VA PIV System has a requirement to continue using LogRhythm maintenance subscription services to monitor the availability and reliability of the PIV System and subsystems to maintain high availability. Failure to acquire LogRhythm maintenance services increases the risk of service and data loss, loss of statistics, reports and other administrative information, causing the inability to safeguard VA PIV System and ultimately putting the entire PIV Service at risk

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined however that limited competition is viable among authorized resellers for this brand name item. In accordance with FAR 16.505(a)(4)(iii)(A) this justification will be submitted to all applicable NASA SEWP V GWAC holders along with the Request for Quotation in order to fully notify all interested parties.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed by periodically reviewing literature and websites of software providers offering similar products and maintenance.

8. Market Research: PIV subject matter experts (SME) conducted market research in November 2017 by analyzing and comparing technical specifications between the VA-owned LogRhythm appliances and commercial off the shelf software from manufacturers other than LogRhythm. VA PIV SMEs compared software maintenance subscription services from AlienVault, EMC, Hewlett Packard, International Business Machine, Intel, McAfee, Micro Focus, Oracle, SolarWinds, Splunk, Symantec, Tenable, TIBCO, Tripwire, and TrustWave with LogRhythm. The SMEs’ technical analysis found that each manufacturer provides maintenance subscription services only for its particular product. Based on the market research, only LogRhythm and LogRhythm resellers can provide the required software maintenance subscription services. The VA PIV SMEs performed market research by searching literature, vendor and web sites, price catalogs, the General Services Administration database, the NASA SEWP V GWAC catalogs, and other documentation or information provided by vendors. Based on the market research, only LogRhythm and LogRhythm authorized resellers can provide the required software maintenance subscription.

Additional market research was performed in January 2018 utilizing the NASA SEWP V GWAC Provider Lookup tool, which resulted in the identification of multiple authorized resellers of the required brand name software maintenance. This market research further indicated that the required brand name software maintenance and support is offered by 12 Service Disabled Veteran Owned Small Business contract holders. As a result, there is a reasonable expectation that limited competition exists on the NASA SEWP V GWAC for the brand name LogRhythm software maintenance.

9. Other Facts: None.