36C10B20Q0486_JA_Post award requirement.pdf

CyberArk Brand Name Control No. VA-20-00079634

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs

Office of Procurement Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a one-year, firm-fixed-price (FFP) delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) Government-Wide Acquisition Contract (GWAC) to acquire brand name CyberArk Core Privileged Access Security, ”CorePAS”, Solution with subscription based credential protection, session isolation and recording, and privileged attack detection. A 12-month warranty and maintenance period for the CyberArk Privileged Access Management (PAM), Central Policy Manager (CPM), Enterprise High Availability module, Enterprise Disaster Recovery module, Application Access Management, AAM, agentless Central Credential Provider, CCP, Application Access Management, AAM, agent based Central Credential Provider, CP, licenses are included and separately priced in addition to hardware maintenance.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information Technology (OIT) Information Technology Operations and Services (ITOPS), Infrastructure Operations (IO), Cybersecurity Management requires transfer and renewal of two(2) existing CyberArk Privileged Access Security Solution licenses packages that are terming in September 2020. The first consisting transition our current a-la carte licenses to enterprise level Core Privileged Access Security (CorePAS) licenses and privileged account credential vaulting service which were previously purchased using Appropriated Funds (AF). The second is the renewal of the perpetual license of the Application Access Manager (AAM) that was originally procured in 2019 using Franchise Funds (FF). VA requires CyberArk brand name software and hardware maintenance, and perpetual and subscription licenses and support. VA’s Continuous Readiness Information Security Program (CRISP) requires the security of all privileged accounts human and non-human. Using least privileged provides enforcement of access to accounts and/or passwords preventing privileged escalation and the ability for users/attacker to move laterally through VA systems. Password management includes Windows, *NIX, Mainframe zOperating System and Resource Access Control Facility, RACF, application, database, and network devices. Through automation CyberArk shall rotate passwords to meet VA’s policy, industries standards, or sooner. Along with the ability through auto-discovery of privileged credentials and hard-coded passwords. The privileged credentials can be secured in the vault and password changed to restrict the use of the account outside of proper authorization.

Requirements to maintain VA’s applications operation and availably for Veterans, requires minimum downtime. AAM’s ability to keeping credentials secure, automated password rotation per policies and keeping the applications operational for Veterans is vital. CorePAS provides real-time auditing and monitoring of privileged access. If malicious activity is identified the solution will alert/suspend or terminate a session/block activity preventing any further damage to the VA’s network. Additional monitoring is provided through communication with other VA Network Security tools, i.e. Forescout, QRadar, Splunk, FireEye. Along with session recording and keylogging. These files are maintained in the secure vault, with limited access for reviewing. The session provided a full extensive visibility of audit trails through isolation of vault to server connections. The combined CorePAS is a mutually supported security “ecosystem” which is collectively referred to as CyberArk brand name. The CyberArk brand software meet all the above requirements and is the only solution available to fulfill the VA capabilities and requirements. Finally, once accepted, the VA requires maintenance licensing to be scheduled to start contiguously once the current CyberArk licenses expire; the required maintenance includes 24/7 telephone and email support, software updates, patches and defect support for one year. This total estimated value of the proposed action is ……..

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: This is a brand name justification in support of FAR 11.105, Items Peculiar to One Manufacturer.

CyberArk brand name software is the only software that can continue to seamlessly build upon Cybersecurity Management’s existing CyberArk Privileged Access Security Solution ecosystem that current contains the following in-flight solutions (1) CyberArk Enterprise Password Vault (AP), (2) CyberArk Privilege Account Management (AP) and

(3) Application Access Manager (FF). Additionally, VA partnered with the Department of Homeland Security (DHS) in adopting the Continuous Diagnostics and Mitigation (CDM) program as an implementation enterprise strategy that is being implemented across the VA at an enterprise level. As part of this interagency partnership, VA will be required to use DHS tested and approved tools for privilege account management. The CyberArk brand tool is one of the few tools that meets the strict DHS CDM tools requirements and is the preferred tool in the privileged account management and credential vaulting category. Additionally, no other brand name elevated privilege account auditing, tracking and password vaulting system has been determined to be interoperable or compatible with the currently fielded CyberArk architecture. Specifically, the system and software communicates through a source code that is based on CyberArk proprietary data. No other software can provide this communication capability without this source code. In the VA’s current architecture, only CyberArk brand name security appliances can provide upstream forwarding of any localized elevated privilege account auditing, tracking and password vaulting data into the existing IO Cybersecurity Management’s SIEM architecture. The upstream of data is critical to produce a single view collective status of all elevated privilege account auditing, tracking and password vaulting related information localized in a system or over the network. This will ultimately provide VA a single interactive view that displays the monitored VA’s user, system and network’s security posture of all elements of Information Technology (IT) protection. Furthermore, any other brand name software cannot accomplish this because another product cannot communicate, nor integrate with the architecture and licensing of, the Enterprise Operations Security’s Console, and thus will not allow security visibility of elevated privilege account auditing, tracking and password vaulting activity on the network. Additionally, elevated privilege account auditing, tracking and password vaulting by another vendor will not integrate with the existing toolset.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name CyberArk brand name products. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website (beta.SAM.gov) and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the agency will work with the program office to continue to perform market research to consider and ascertain if any other sources can provide these services in the future.

8. Market Research: Market research was conducted in January 2020 to July 2020.

The Government’s technical experts reviewed similar software products to ascertain if these items could meet VA’s requirements. Specifically, the technical experts conducted internet searches to find and elevate privilege account auditing, tracking and password vaulting systems to determine if they meet the below listed requirements.

Privileged Access Management requirements:

a) Function and interconnect with current IO production CyberArk Password Vault and CyberArk Application Access Management.

b) Integrated functions with existing IO Cybersecurity tools Forescout, QRadar Security Information and Event Management, FireEye Advance Persistent Threat

c) Integrates with Windows, *NIX, Apple/MAC, Mainframe

d) Application credential management

e) Elevated privileged solution needs be able to function under current knowledge.

http://www.beta.sam.gov/

The below chart shows the vendors that were found and if they meet the VA requirements.

Brand Meets Government’s requirement CyberArk Yes Preempt No - does not meet a, b,c,d & e Quest No - does not meet a, b,c,d & e Centrify No - does not meet a,& e

Based on the above review of the products, the Government’s technical experts determined that only CyberArk is capable of providing the requirement. None of the other products are able to meet all of the Government’s technical, interoperability and compatibility requirements. Additional market research was conducted in July 2020 by utilizing the NASA SEWP V GWAC portal Provider Lookup Tool to determine whether the CyberArk Privilege Access Management brand name software is available from resellers that hold NASA SEWP V contracts. Based on this market research, it was determined there are multiple service-disabled Veteran-owned small business authorized resellers under NASA SEWP V GWAC capable of meeting the Government’s requirements.

9. Other Facts: None

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among NASA SEWP V GWAC holders.

Additionally, NASA SEWP determines that all catalog prices on its GWAC’s are fair and reasonable. Additional price analysis may be performed in accordance with FAR 15.404-1(b).

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed $700,000, the certification below required by FAR 16.505(b)(2)(ii)(C)(1) serves as approval.