NNG15SD19B-188.pdf

Control Number TAC-20-57317

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for the renewal of brand name Entrust certificate software maintenance.

3. Description of the Supplies or Services: VA, Office of Information and Technology, Information and Technology Operations and Services, Solution Delivery, Directory Services, has a requirement for the renewal of software maintenance on 550,000 existing VA-owned brand name Entrust certificate licenses to support an Interagency Transaction with the Department of the Treasury (Treasury) to provide Public Key Infrastructure (PKI) services for VA in support of a Shared Service Provider (SSP). As an SSP for PKI services, the Department of Treasury, Bureau of the Public Debt (BPD), currently provides PKI support services to VA. VA provides these licenses to BPD as Government Furnished Property. Since Fiscal Year 2013, VA has held agreements with BPD to install, operate, and maintain a PKI enrollment server which provides VA with the ability to issue web and device based PKI and encryption certificates to users across the VA enterprise. The current Interagency Transaction was entered into on July 17, 2019 and expires on July 16, 2020, at which time the Interagency Transaction is anticipated to be renewed. These licenses allow VA a limited web based PKI administration platform for the issuance and management of 550,000 end entity certificates within the VA enterprise. The required certificate authority administration software includes capabilities for auto enrollment, user management and user registration and enrollment server for the web management of encryption certificates.

VA must provide these licenses as Government Furnished Property to the BPD as an SSP for PKI services to VA. The Contractor shall also provide software maintenance to include 24 hours per day, 7 days per week technical phone support, software patches, bug fixes, and version upgrades. The period of performance shall be December 5, 2019 through December 4, 2020, plus four 12-month option periods, if exercised.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section eight of this justification, it was determined that limited competition is viable among resellers of the required brand name Entrust certificate software maintenance. VA has a critical need to continue the existing licenses with Entrust.

Entrust Certificate Software Maintenance Control Number TAC-20-57317

Entrust is the current software that the BPD uses for its entire customer base, which includes VA. VA utilizes BPD as an SSP for its PKI services and Entrust is the only software that is interoperable and compatible with the BPD hardware currently installed in its PKI management environment. The current infrastructure used by the BPD utilizes Entrust and VA needs to communicate with that infrastructure and can only use Entrust software due to the proprietary code that only allows Entrust certificates to be issued from the Entrust software that BPD hosts. The infrastructure for which the VA PKI resides on is a shared infrastructure with the rest of the Treasury PKI SSP program.

Any other product, other than Entrust, would not communicate and work with the Treasury’s infrastructure. VA requires Entrust for continued operational availability.

Therefore, software from other providers would not be supported by the BPD infrastructure.

Maintenance is required for software updates and patches to VA’s current Entrust software licenses. These updates and patches provide new feature sets, address program errors in prior software versions, and provide security enhancements. Only Entrust, through a reseller, can provide the necessary software upgrades and patches because of the proprietary source code required to develop and implement software updates. Since the software is proprietary, a legal restriction is placed on access to the software code that is required in order to develop upgrades and patches to the software.

Without this access it is impossible for another source to modify the software code as necessary to provide the required patches and upgrades. No other source other than an Entrust reseller can provide the required maintenance support requirements described herein, such as assistance via phone and email, as well as all software upgrades and patches.

6. Efforts to Obtain Competition: Currently, no other companies other than Entrust or a reseller can provide the required software maintenance. Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, by the undersigned VA technical representative that limited competition is viable among resellers for this brand name Entrust certificate software maintenance acquisition. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the notice of award of this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed. VA technical Subject Matter Experts regularly review industry trade publications and conduct internet research to ascertain if any other software is available to meet the requirements described herein.

Entrust Certificate Software Maintenance Control Number TAC-20-57317

8. Market Research: The Government’s technical experts conducted market research in September 2019 by reviewing similar software products to ascertain if these items could meet VA’s requirements. Specifically, the Government’s technical experts conducted web-based research from Verisign, Inc., Verizon Communications, Symantec Corporation, and SafeNet, Inc. as other PKI providers. VA reviewed each of the possible sources’ product information and it was determined that only Entrust meets VA’s requirements. All other PKI providers use a different PKI vendor suite that is incompatible with the current BPD infrastructure. Furthermore, no other vendor, including those reviewed by the technical experts, has the capability of issuing software patches, bugs, fixes, and version upgrades for Entrust certificate licenses necessary to support the existing VA requirement. Based on the above, only Entrust certificate software maintenance meets all of the Government’s requirements.

A Request for Information was released on NASA SEWP V GWAC on September 18, 2019 to all Contract Holders. Three vendors responded: 2 authorized resellers from Group C, ETSI and New Tech Solutions; 1 Group D – Sterling Computers. All three responses received were considered technically acceptable.

Additional market research was conducted by the Government in October 2019 by utilizing the NASA SEWP V GWAC Provider Lookup tool to determine whether the brand name Entrust certificate software maintenance is available from NASA SEWP V GWAC holders. It was determined that there are 14 resellers of the brand name Entrust certificate software maintenance that hold current GWACs such that limited competition is anticipated.

9. Other Facts: None.