NNG15SD18B-012.docx

Control Number TAC-18-XXXXX Okta Identity Cloud IDaaS aMAUs Control Number TAC-19-54627

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1) Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2) Description of Action: The proposed action is for a firm-fixed-price Delivery Order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC), for the procurement of Okta Identity Cloud Identity as a Service (IDaaS) active Monthly Access Users (aMAU) and associated technical support.

3) Description of Supplies or Services: VA Office of Information and Technology (OI&T) Enterprise Program Management Office (EPMO), Project Special Forces requires Okta Identity Cloud IDaaS aMAUs and associated technical support, directory services, Application Programming Interface (API) access management, single sign on, adaptive multi-factor authentication, federation from multiple different credential providers, lifecycle management, registration, reporting, and logging for use on VA’s API Management Platform (previously referred to as the API Management Platform and the Future Technology Laboratory (FTL)). VA’s API Management platform contains a cloud-based sandbox, a development infrastructure and software as a service platform that is publicly accessible and external to the VA’s internal network, used by outside developers to create digital products on behalf of VA utilizing APIs available through VA’s API gateway. The Okta aMAUs, utilized during the initial 9-month pilot of the FTL/API Sandbox environment, (which was originally competed) are necessary to authenticate developers as VA expands the API Management Platform as well as Veterans who will require access to participate in usability testing of the developed digital products. The resultant Delivery Order will have a 12-month Base Period and two 12-month option periods each with a quantity of 14 Million aMAUs to support usage of applications/websites including but not limited to VA.gov, Apple and Android Health, USA Jobs, Mobile App Squares, VA Video Connect, Annie, Open Burn Pit, and one additional application a month starting in August of 2019 that will stay in production and further be integrated into ID.me. Based on an analysis of usage, each application owners marketing or planned marketing of that application the Government determined that the usage could come in closer to 17 million aMAUs. Therefore, to ensure that there is a sufficient number of aMAUs available the Government is including three optional tasks consisting of 900,000 aMAUs in the base period and each option period.

4) Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5) Rationale Supporting Use of Authority Cited Above: Based on extensive market research, as described in paragraph 8 of this document, it was determined that limited competition is viable among resellers for the brand name Okta Identity Cloud IDaaS aMAUs and associated technical support. The required Okta iDaas code is proprietary to Okta. VA contacted Okta in October 2018 to ascertain if the proprietary code is for sale. Okta advised that their proprietary code is not for sale. The FTL, now a part of VA’s API Management Platform program, is specifically configured to only utilize Okta IDaaS aMAUs as its means of authenticating users and the planned expansion of the API Management Platform will require an increase to the number of Okta IDaaS aMAUs. Only Okta brand name IDaaS can meet all of VA’s interoperability and functional capability requirements. Specifically, the Okta Identity Cloud IDaaS utilize Okta’s proprietary code. Access to Okta’s proprietary code is necessary for the expanded environment to fully interoperate with the existing Okta Identity Cloud IDaaS currently fielded, without severely comprising the operational integrity of the currently deployed solution and the 20+ applications that are currently utilizing it. The Okta IDaaS in the FTL leverages an industry unique combined stack of IDaaS services including API Single Sign On components, API authorizations and API gateway integrations that will only interoperate with Okta’s proprietary code. Any other brand name IDaaS software utilized to expand the platform would not communicate or function properly with the existing Okta solution due to the aforementioned proprietary constraints. Use of any other brand name IDaas would require a complete replacement of the currently fielded products and a significant reengineering of the API Management Platform, which would result in extensive delivery delays and duplicated costs that would not be recovered through competition. Specifically, VA would require duplicative support to conduct extensive planning activities to determine the necessary configurations for the new solution, reconfigure network settings and security configurations accordingly, develop, engineer, secure and build a new working solution, conduct functional and security testing of the new solution, complete a new Authority to Operate (ATO) in Risk Vision, and work with all 126 external developers currently utilizing Okta in the sandbox and 5 developers in production to adopt the new solution. It would also require significant retooling of the current technology stack resulting in a reduction of the number of apps that VA is fielding to serve Veterans regarding healthcare, benefits, verification, and cemeteries. This would result in a delay of at least 12-months and additional duplicated costs of approximately $ to reconfigure the FTL that would not be recouped through competition. Additionally, only Okta has access to Okta’s proprietary code base to provide the required support for the Okta IDaaS. This code is needed to ensure all services provided are properly configured. Accordingly, Okta is the only IDaaS provider that meets all of VA’s identity and access management, interoperability and functional requirements, and maintenance requirements, as stated above. Without the Okta solution, the VA would not have the ability to scale with the growing number of users utilizing the various applications/websites listed in paragraph 3 above. Okta provides an industry unique combination of out-of-box custom domain operations and custom consent pages to securely manage the OAuth2 workflow requirements of VA’s API Management Platform. This provides both an optimized, frictionless experience for the veteran/end-user and a reduced risk of unauthorized access to health data by providing a custom domain location for API services (such as oauth2.va.gov) and a custom consent experience for the veteran. (i.e. the authorization flow requests consent from a veteran/caregiver/VSO/etc. before serving associated API data to the requesting target application). Attempting to accomplish these tasks through another technology would require infrastructure support and extensive custom code development of the entire veteran consent workflow. Okta provides this functionality out-of-box entirely as-a-service without the need to deploy and support any hardware or software within VA’s infrastructure – resulting in significant cost reduction and an accelerated deployment of veteran services at scale. The speed and agility of Okta’s Identity Cloud allows VA’s API Management Platform to onboard and integrate new applications in days/weeks vs. the 6 plus months typically seen in this process today. Failure to obtain these Okta aMAUs would result in the VA to continue to build and maintain our own software at a higher cost with increased downtimes causing us to move resources from valuable projects. We would not be able to support key integrations with external and internal applications and internal developers would assume the risk. By having this delivery order in place we shift the risk from the VA to the IDaaS vendor. In addition of not having this IDaaS in place we would assume more risk in downtime of the application and the Veteran would experience downtime when trying to log into the application resulting in frustration and not being able to access their VA benefits online. Shifting to an IDaaS model we transfer that risk to the vendor through service-level agreements and other techniques.

6) Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however that limited competition is available among resellers for brand name Okta IDaaS aMAUs, as well as technical support. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the resultant Delivery Order will be synopsized and the justification will be made publicly available on the Federal Business Opportunities Page within 14 days of award of the order.

7) Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to perform market research to determine if there are any new products available that will fulfill the Government’s requirements.

8) Market Research: Market Research was conducted by VA technical experts from December 2017 through January 2019. The research included a review of Gartner’s 2018 Magic Quadrant for Access Management, Worldwide and The Forrester Wave: Identity-As-A-Service to research the capabilities of other sources which included evaluation of product vendors such as Microsoft, Oracle, CA, Ping and IBM. Based on the market research it was determined that none of the other review products can meet the interoperability and/or maintenance requirements, as outlined in Section 5 of this Justification. Accordingly, Okta IDaaS was determined to be the only product that could meet VA’s requirements.

Additionally, a Request for Information was conducted in January 2019 on the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) which found three Service-Disabled Veteran Owned Small Business resellers that had the capability of meeting the requirements.

9) Other Facts: None.

10) Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date: __________________________

IT Specialist Signature: ______________________

11) Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on

Date: __________________________

Contracting Officer Signature: ______________________

12) Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Date: __________________________

Contracting Officer Signature: ______________________

13) Legal Sufficiency Certification: I have reviewed this justification and find it adequate to support an exception to fair opportunity and deem it legally sufficient.

Date: ________________________________

Legal Counsel Signature: _____________________________

Approval In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Okta Identity Cloud IDaaS aMAUs with associated technical support on an other than fair opportunity basis pursuant to the authority cited in paragraph 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

pg.