NNG15SD37B-003.pdf

CyberArk Software and Maintenance Support Control Number TAC-19-53052

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs Office of Procurement, Acquisitions, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price (FFP) delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name CyberArk software, maintenance and technical support services.

3. Description of the Supplies or Services: VA’s Continuous Readiness Information Security Program (CRISP) requires system security monitoring of all privileged user accounts, system logs and network connectivity to provide event and log correlation, event alerting and information security threat intelligence, and reporting of all malware activity. To meet CRISP requirements, Office of Information Technology (OIT) Information Technology Operations and Services (ITOPS), Infrastructure Operations (IO), Cybersecurity Management Division currently utilizes an integrated Security Information and Event Management (SIEM) solution that is spread across ten (10) IO data centers. The purpose of this proposed acquisition is to renew maintenance and technical support for existing CyberArk hardware and software components, as well as procure 1,000 CyberArk Application Access Management (AAM) licenses with maintenance and technical support. The existing components consist of two (2) CyberArk Advanced Appliance Servers, eight (8) 16-gigabyte memory packs, two (2) Central Policy Manager (CPM) modules, five (5) Enterprise Password Vault (EPV) user licenses, and 30,000 Privileged Session Manager (PSM) Target System licenses. The new AAM licenses are required in order to expand existing functionality and provide VA with enhanced privileged account management capabilities that are currently not available within the existing infrastructure. Maintenance and technical support includes 24x7 telephone and email support, software updates, patches and defect support.

Delivery of the licenses are required within 30 days of award, and the maintenance and technical support shall be for 12 months with two 12-month option periods. The total estimated price of the proposed action, inclusive of the option periods, is .

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based upon market research, as described in paragraph eight of this justification, it was determined that limited competition is viable among resellers for the required brand name CyberArk software, maintenance and technical support. CyberArk is the only solution that meets all of VA’s functional requirements for elevated privilege account auditing, tracking and password vaulting to include upstream forwarding of any localized data center. The upstream forwarding of data is a VA functional requirement and is critical to produce a single view, collective status of all elevated privilege account auditing, tracking and password vaulting related information localized in a data center system or over the network. This provides VA with a single interactive view that displays the monitored user, system and network’s security posture of all elements of IT protection. VA’s current SIEM-based user account system and network monitoring cyber security system is based upon existing CyberArk proprietary hardware and software and VA requires additional software to meet CRISP requirements that is compatible with the existing infrastructure and functionality for continued operational availability. Specifically, the new licenses procured under this effort will provide additional privileged account management capabilities, and only CyberArk AAM licenses can seamlessly integrate with current proprietary infrastructure to provide this enhanced functionality. Other brand name solutions, as detailed in section eight of this justification, are not interoperable or compatible with the currently fielded CyberArk SIEM-based brand name architecture components. Specifically, the hardware and software communicate through a source code that is based upon CyberArk proprietary data. The proprietary configuration applies in a very specific way to the additional software that is being purchased. No other software can provide this communication capability without the proprietary source code. Therefore, only CyberArk software has the ability to meet VA’s functional requirements, and no other brand name software can integrate or communicate with VA’s existing CyberArk proprietary infrastructure to provide the required privileged account management capabilities. Failure to acquire compatible software would cause system failure, and would ultimately require a complete replacement of the existing CyberArk SIEM-based infrastructure. Specifically, the integrated SIEM solution consists of five (5) CyberArk Advanced Appliance and High Availability/Disaster Recovery Servers, eight (8) 16-gigabyte memory packs, two (2) Central Policy Manager (CPM) modules, five (5) Privileged Session Managers modules, 10,000 Enterprise Password Vault (EPV) user licenses, and 30,000 Privileged Session Manager (PSM) Target System licenses. These replacement efforts would result in extensive delivery delays and duplicated costs estimated at $17M that would not be recovered through competition, and would put VA’s security posture at risk. This estimate is based on historical efforts conducted to create the existing environment.

In addition, VA requires the renewal of maintenance and technical support for the existing CyberArk hardware and software components as well as for the new CyberArk AAM software. Only CyberArk, through its resellers, can access to the proprietary software code to provide the required maintenance and technical support for the new and existing hardware and software, which includes updates, patches and defect support. Access to this code is also needed to ensure all services provided are properly configured.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among resellers for brand name CyberArk hardware, software, and technical support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed.

8. Market Research: The Government’s technical experts conducted market research by reviewing other similar elevated privilege account auditing, tracking and password vaulting systems. This market research is an ongoing process starting in 2015 and continuously being conducted, as recently as March 2019. The other similar software reviewed included Quest Software and Computer Associates. Based on reviews of these products, the Government’s technical experts determined that neither of these products can meet the Government’s technical, interoperability and compatibility requirements with the existing CyberArk infrastructure as previously discussed.

Additionally, as stated above in section five, only CyberArk, through its resellers, can provide the required maintenance and technical support. Based on all of these market research efforts, the Government’s technical experts have determined that only CyberArk brand name software, maintenance and technical support can meet all of VA’s needs.

Additional market research was conducted in June 2019 by utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name CyberArk products are available from NASA SEWP V GWAC holders. It was determined that there are several resellers of the brand name CyberArk products that hold current GWACs such that limited competition is anticipated.

9. Other Facts: None.