NNG15SD25B-051.pdf

Agilliance RV Maintenance and Support Services Control Number: TAC-18-48083

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a brand name firm-fixed price delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for Agilliance RiskVision (RV) maintenance and support services.

3. Description of Supplies or Services: This proposed action is for maintenance renewal and 3944 hours of associated support services that will enhance the existing Agilliance RV Governance, Risk and Compliance (GRC) tools. The Agilliance RV GRC tools provide an effective enterprise wide Continuous Monitoring (CM) capability for enhanced decision making for improved organizational risk management. VA currently owns Agilliance RV licenses for the tools and needs to renew maintenance for the existing licenses in order to receive required product downloads, software patches, and 24-hour a day, seven days a week, 365 days a year (24x7x365) coverage. No software licenses will be renewed or procured under this proposed action. The period of performance is 12 months with two 12-month option periods.

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) 16.505 (b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, it was determined that limited competition is viable among authorized resellers. Agilliance is the manufacturer of the existing RV GRC tool currently fielded. No source, other than Agilliance, or its resellers, can provide the maintenance and support services since access to Agilliance’s proprietary code is required. Access to this code is required to develop product downloads and software patches and to ensure all the services provided are properly configured. The existing enterprise Agilliance RV GRC tools were deployed to support VA’s CM program and provide detailed information security vulnerability and compliance information to support Authorization & Accreditation (A&A) decisions in the Authority to Operate process. The initial deployment of Agilliance RV GRC was successful and demonstrated the tool’s capabilities to provide a wide range of data to information security practitioners and senior executives Department-wide. Renewal of maintenance is required in order to keep the deployed RV tools current and in proper operating order. The existing Agilliance RV GRC tool is operationally integrated into VA’s business and technical processes. RV is used as a primary data source for VA’s CM program. Other products, services and business processes are tied specifically to the Agilliance RV GRC tool.

Agilliance RV GRC provides bi-directional data connectors to International Business Machines (IBM) Endpoint Manager (IEM) and utilizes a technical connector to the Nessus Enterprise Web Tool (NEWT). Use of another vendor’s product would remove VA’s visibility into assets, vulnerabilities and security compliance of devices deployed across the Department, which would insert an unacceptable level of risk into the VA’s ability to satisfy oversight of security requirements, visibility into vulnerabilities and their remediation capabilities, and the ability to report compliance efforts to both the Office of Management and Budget (OMB) and Congress. Moving to another source would put VA at risk of non-compliance with Federal Information Security Management Act CM requirements and OMB Memorandum M-11-29, which states agencies will develop and operate “well-defined, well-managed continuous monitoring and standardized risk assessment processes.”

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name RV maintenance. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: VA conducted market research in May 2018 to determine if other GRC vendors could deliver the required maintenance. Specifically, VA conducted an analysis of Rivest, Shamir, and Adleman (RSA) Archer, and IBM to determine if their services could meet VA’s needs and if their products contained application workflows that could be integrated into RV’s tool. VA determined no other product could provide the maintenance for the existing RV Tool without access to the proprietary data as outlined in Section 5 of this Justification. RV is the only product platform that can provide the required maintenance support for the existing RV suite. Failure to obtain the requested services puts VA’s CM and information security program at risk of compromise. VA management and security staff will not have the necessary information to detect and mitigate risks to VA systems and prioritize work efforts to protect sensitive Veteran information.

Additional market research was conducted to determine if limited competition is available among resellers by issuing Request for Information (RFI) #9044 on NASA SEWP V GWAC on June 12, 2018. Only one authorized reseller, Three Wire Systems, responded and was able to meet the requirements. The NASA SEWP V GWAC Provider Lookup Tool was also utilized on August 2, 2018 to search for

Agiliance resellers. The search yielded seven resellers including three Service- Disabled Veteran-Owned Small Businesses. There is reasonable expectation that limited competition exists on the NASA SEWP V GWAC for Agilliance RV GRC tools.

9. Other Facts: None.