NNG15SD19B-167.pdf

Linux Active Directory Integration Control Number: TAC-19-53699

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition & Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise- Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for software maintenance support of 7067 currently installed Centrify products and procurement of additional brand name Centrify licenses and maintenance support to support growth in deployed Linux/Unix systems.

3. Description of the Supplies or Services: VA Office of Information and Technology (OI&T), Infrastructure Operations (IO) has a requirement for software maintenance support for currently installed Centrify software throughout VA. Centrify software is used to manage access for VA users to VA systems running Linux based on the Active Directory (AD) credentials of the user. VA has a large Microsoft Active Directory forest composed of 33 domains in a single AD tree with approximately 600 Domain Controllers (DCs), distributed across the country. The Internet Engineering Task Force, Request for Comments 2307 AD schema extensions for UNIX are currently supported. AD management is performed by groups separate from the Linux administrator groups. VA currently uses the Centrify Suite to integrate Linux/Unix systems with AD, with 7067 licenses currently active. The maintenance support includes downloads, upgrades, troubleshooting, and 24 hours per day, 7 days per week, 365 days per year technical support for the currently installed Centrify software.

These services will ensure the Software remains operational. Further, VA requires optional tasks for a not to exceed amount of 12,000 additional licenses during the period of performance, to meet future demands for Centrify software, and maintenance for anticipated system upgrades. The software maintenance period of performance shall be from May 15, 2019 through May 14, 2020 with two 12-month option periods and one optional task for additional software and maintenance.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”

5. Rationale Supporting Use of Authority Cited Above: Based on extensive market research as described in section 8 of this document, it has been determined that limited competition is available among resellers of the required Centrify brand name software maintenance support. The existing Centrify perpetual software licenses provide the underlying core functionality necessary for AD administrators to manage the VA systems running Linux/Unix within AD. The existing solution includes managed agent software which is installed on each of the VA systems running Linux/Unix and a proprietary management interface to AD. The agent software provides communications with AD for user authentication and authorization.

VA requires additional software licenses to work with the existing licenses. VA has existing licenses in place that are owned by VA. Use of any other brand software would result in critical interoperability and compatibility issues with the current infrastructure due to the proprietary relationship between the management interface and the agent software. Existing Centrify brand name software requires upgrades over time as well as maintenance support.

Centrify has proprietary rights to the software and associated maintenance services. Any source that provided these services must have access to Centrify proprietary code. Access to this code is required to ensure all services provided are properly configured. Therefore, the required maintenance services must be compatible with the existing software. Only Centrify, or an authorized Centrify reseller, has the rights to perform these maintenance services. Only Centrify brand name software licenses and maintenance can meet all of VA’s requirements, specifically compatibility and interoperability with VA’s existing AD infrastructure integrated with critical business systems running Linux/Unix operating systems.

Of solutions reviewed, only Centrify provides Federal Information Processing Standards (FIPS) 140-2 Validated encryption modules. Centrify has proprietary rights to the software licenses currently being used by VA throughout the virtual infrastructure. Given that Centrify has proprietary rights, there are no other authorized vendors that can provide the maintenance services without voiding the licenses currently in use. Due to Centrify copyrights, proprietary database structures, and proprietary software application programming interfaces no other source can provide the software and support required for maintaining these high availability information systems.

The install base of Linux systems continues to grow and for AD integration of those systems VA needs to purchase additional licenses of an AD integration product. Use of any other brand name item, would require a complete replacement of the existing Centrify software licenses resulting in delivery delays of 1 year and 6 months and duplication costs of $1.9M that would not be recovered through competition. These estimates are based on previous efforts for similar software.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that limited competition is viable among authorized resellers for the required brand name items, associated maintenance and services. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized within 14 days of award on the Federal Business Opportunities Page (FBO) along with a copy of this justification. Further, this justification will also be posted to the NASA SEWP V GWAC website along with the Request for Quotation.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the agency will work with the program office to perform additional market research so that other solutions can be considered.

8. Market Research: The Government technical experts conducted market research in January 2019 by reviewing similar software and maintenance and determined that no other products or services would be compatible or interoperable with VA’s existing application management consisting of Centrify software. The software and services reviewed by the

Government technical experts included Privileged Access Suite for UNIX (PASU). They do not meet the needs as outlined in Section 5 of this J&A. This product lacks the FIPS 140-2 Validated encryption module. FIPS 140-2 is essential for VA to comply with all security controls documented within VA Handbook 6500. This alternative product would require extensive duplication of effort by the VA Platforms and Operating System teams to deploy and would have to be stood up in parallel to the existing Centrify infrastructure.

Additional market research was conducted in February 2019, wherein the Government’s technical experts utilized the NASA SEWP V GWAC Provider Lookup tool and identified several sources capable of meeting VA’s needs. Specifically, eight verified service disabled Veteran-owned small business resellers were identified as resellers of this product.

Therefore, VA does anticipate limited competition for this action.

9. Other Facts: None.