NNG15SD34B-100.pdf

Imperva Web Application Firewall Control Number: TAC-18-50933 Appliances

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price (FFP) delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for six brand name Imperva X6510 Web Application Firewall (WAF) appliances equipped with hardware and software components, as well as maintenance support services and training.

3. Description of Supplies or Services: VA’s Continuous Readiness Information Security Program (CRISP) requires six Imperva WAF’s to be installed at the Austin Information Technology Center (AITC). These will be used to upgrade the current WAF and Security Information and Event Management (SIEM) to allow system security monitoring of all system logs and network connectivity that provides event and log correlation, event alerting, information security threat intelligence, and reporting of all web application activity, which is used as a web application firewall for data center systems and networks. The required Imperva WAFs will allow existing Infrastructure Operations (IO) to continue enhancing AITC’s Security Monitoring Center which centrally manages Information Technology (IT) security operations of all IO data centers and to continue providing support for VA’s applications. VA needs to acquire additional software licenses to ensure the continued operational success for system security monitoring, Application virtual appliances for management, reporting and integration with existing IO systems.

This effort will include professional onsite training of the Imperva WAF hardware and software. Additionally, the Contractor shall provide one year of Imperva’s “Government Support” for the X6510 appliances. The software maintenance shall include software upgrades, updates, patches, and defect remediation. The required warranty and maintenance includes 24/7 telephone and email support, and license to be perpetually assigned to the associated WAF appliance. Additionally, the contract shall provide a 12-month subscription to the Imperva ThreatRadar Reputation Services for the X6510.

The Imperva WAF appliances and license will be delivered within 30 days after award.

The warranty/maintenance period will commence upon VA’s acceptance of the Imperva WAF appliance and software licenses. The total estimated value of the proposed action is.

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled, “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this document, it has been determined that limited competition for Imperva X6510 WAF appliances is available among authorized resellers for these products. Due to the proprietary nature of the software code in the existing IO WAF and SIEM infrastructure which is based on existing Imperva software and hardware, only the Imperva WAF solution of hardware and software will meet VA’s requirements due to compatibility and interoperability constraints with the proprietary solution. Currently, there are 11 VA enterprise data centers that have an Imperva WAF infrastructure. This action will upgrade/refresh five of these sites that currently have equipment that will be end of life in fiscal year 2019. Only Imperva software can communicate with the existing IO for the purposes of analyzing physical infrastructure and monitor the overall status of the VA network. As this is a technical refresh of current Imperva hardware and software licensing, VA requires compatible/interoperable software and hardware in order to expand WAF capabilities and services as required. Only Imperva through an authorized reseller can provide the required software to upgrade and expand the current IO WAF and SIEM infrastructure. No other brand software or hardware is compatible with or interoperable with the existing Imperva proprietary database structures, protocols, and software application programming interfaces. Specifically, due to Imperva proprietary source code that runs on the existing IO WAF and SIEM infrastructure, if another manufacturer’s products were introduced, the hardware and software would not be able to communicate with the existing brand name items. Additionally, 11 total data centers would be affected if another brand name would be used at the five sites being refreshed under this proposed action. Use of any other brand name software would require complete rebuilding and redesign to communicate and signal using all of these fielded technologies at the eleven total data centers and would ultimately result in continuance of ineffective monitoring of datacenter environmental conditions. In addition various software and hardware that is installed at the other 6 data centers would require replacement if another brand name was procured due to the aforementioned proprietary constrinats. This would result in delivery delays and extensive duplication of costs that would not be recovered through a competition.

In addition, only Imperva, through an authorized reseller, can provide the necessary software upgrades/updates, documentation, and help desk support because of the propriety source code required to develop and implement software updates. Access to this code is also required to ensure all the services provided are properly configured.

Failure to procure these hardware, licenses and associated maintenance would result in ineffective monitoring of datacenter environmental conditions, management of network connectivity, management of IT assets, physical placement of assets, and datacenter capacity planning. As such, VA CRISP would have insufficient monitoring of the health of computer rooms supporting critical System Health Monitoring, Application Health Monitoring, Network Monitoring, Security Monitoring, Event Management, Dashboard, and Reporting. These systems support VA operations and Veterans Health systems such as Veterans Information Systems and Technology Architecture (VistA).

Furthermore, if the required Imperva solution is not procured, the existing VA CRISP infrastructure cannot be expanded. Based on the above, only Imperva brand name software can meet the Government’s requirements.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this document. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined however that limited competition is viable among authorized resellers for brand name Imperva X6510 WAF appliances equipped with hardware and software components, as well as maintenance support services and training. In accordance with FAR 16.505(a)(4)(iii)(A)(2), this justification will be provided with the solicitation to all interested NASA SEWP V GWAC holders. In accordance with FAR 5.301 and FAR 16.505(b)(2)(ii)(D), notice of award of the resulting order will be synopsized and this justification will be made publicly available within 14 days after award on the Federal Business Opportunity website.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions of this requirement, the Government’s technical experts will continue to perform market research to determine if there are any products available that will enable competition. The Government continues to monitor market trends and changes in requirements that could facilitate a more competitive environment. As the solution reaches its projected end of life in 2027, the Government will conduct market research of this solution with a new solution that will be defined so that there will be the opportunity for expansion, interchangeability, and interoperability between and among competitor Web Application Firewall providers.

8. Market Research: The Government’s technical experts performed market research from January 2017 through January 2018 by researching other similar solutions (online and through market literature) to learn if other brand items could meet and be compatible with VA’s existing Imperva architecture (considering connectivity, licensing, operability and management). The Government’s IT Security technical experts reviewed similar solutions from the following companies: Trustwave, F5 and PaloAlto.

The items did not meet VA’s requirements as none of the appliances reviewed met VA’s specific interoperability requirements detailed in paragraph 5. Based on this market research, the Government’s technical experts have concluded that only the Imperva brand name appliance and software will meet IO Security Monitoring Center’s requirements for its central management of IT security operations requirements.

9. Other Facts: None