JA_HBA Extension_Redacted.pdf

Heuristic Behavior Analytics (HBA) Extension Control Number VA-25-00013366

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for three one month extensions for continuous services under the current firm-fixed price (FFP) task order issued under Transformation Twenty-One Total Technology Next Generation (T4NG) Contract VA118-16-D-1025 with Insignia Technology Services, LLC.

3. Description of the Supplies or Services: The VA, Office of Information & Technology (OIT), Office of Information Security (OIS), has a requirement for continual analysis, provision and support of HBA applications. In 2024, a FFP, full and open competitive action under T4NG among Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) and was awarded to Insignia Technology Services, LLC in support of HBA for . This action is for continued Corelight Network Traffic Analytics and Response (NTAR) hardware, maintenance, and software licenses and Everfox m existing HBA application provides real-time, and near-real-time, cybersecurity detection, monitoring, and alerts.

Analytics (UEBA) is a security solution that uses artificial intelligence (AI) and machine learning (ML) and advanced analytics to identify and mitigate cyber threats and high-risk extend the HBA task order will result in these sensors and the UEBA system having zero value and a significantly reduced Cybersecurity visibility into the VA Enterprise enlarging the attack landscape for threat actors to operate in. Continuity and improvement of services is critical to ensure security at VA. Subsequently, continuing these requirements is necessary for the deployment of the HBA capability and the increased security requirements identified. Currently, VA's HBA Solution is comprised exclusively of Corelight hardware, software and Everfox software. The two components are functionally interoperable, and compatible with the overall solution. Specifically, any other brand name item would not be able to communicate with the existing HBA solution. This would result in a loss of visibility to the telemetry provided by these components that are integrated into this solution. This loss of visibility would place the VA, the Veterans data, and the Veterans at significant risk from criminal enterprises and state sponsored adversary exploitation.

A new competitive solicitation was released on August 26, 2025; however, due to questions received from potential offerors, an amendment to the solicitation had to be issued, which also required an extension to the , three one month extensions are required to the existing HBA task order to avoid immediate gaps in continuous support until the new HBA task order is awarded with the

Heuristic Behavior Analytics (HBA) Extension Control Number VA-25-00103366 projected award date of October 24, 2025. The one month extensions will only be funded in 30-day increments with no further extensions upon award, and any potential transition, to the new task order. The total estimated value of the proposed extension is which increases the total contract value to . The first 30-day option is estimated to be

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of 41 U.S.C. Section 4106(c)(2) as providing the supplies or services required at the level of quality required because the supplies or services ordered ar

5. Rationale Supporting Use of Authority Cited Above: As this is an extension to the current contract, no other vendor can immediately onboard support staff and continue support without severely impacting existing services. The services required to maintain the licenses and support of the contract would need to be extended an initial one-month base period to coincide with the projected award date of October 24, 2025. There are two additional one month options to support transition of the contract once awarded to include onboarding and ramp up.

The hardware maintenance and software license subscriptions under this contract are required to ensure HBA can continue to successfully support approximately 600,000 users. While a new requirement is currently solicited and anticipated to be awarded in October there is no other alternate solution for HBA programming and interfacing requirements that can start on day one without time to transition.

The current contract expires on September 24, 2025. The support services which must remain continuous cannot be provided by an alternate vendor due to transition timeframes. It is not feasible to solicit, award, and transition support within the short extension period that supports the HBA solution until the new contract award in October 2025. Switching solutions during the solicitation of the new contract and transitioning support services would degrade license support. Transitioning services is not feasible for the Government because the one to two month onboarding times for staff will lead to the loss of support, causing a backlog of technical issues directly cybersecurity support. Maintaining the current support with the existing vendor is essential. Transitioning to a new vendor would necessitate a significant amount of time for the new team to be able to successfully and efficiently support the HBA solution.

Without extending this contract to continue using the Corelight and Everfox licenses and maintenance, VA could not continue to provide cyber security visibility required to meet mandated Executive Order-14028 (requiring VA to improve its overall security rapidly to better defend and prevent security incidents), OMB memorandums 21-31 (requiring VA to improve its investigative and remediation capabilities related to cybersecurity incidents), 19-26 (requiring VA to implement modern security capabilities related to network traffic), and 22-09 (requiring VA to improve cybersecurity, establish adherence to Zero Trust Architecture, and secure the software supply chain).

If this contract is not extended until the new action is awarded, then it would result in a loss of visibility to the telemetry provided by these components that are integrated into this solution. This loss of visibility would place the VA, the Veterans data, and the Veterans at significant risk from criminal enterprises and state sponsored adversary exploitation.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Contracting Opportunities website, SAM.gov and the justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: While no competition is feasible for the subject extensions, a competitive solicitation for a new task order was issued on August 26, 2025 is projected for award in October 2025.

8. Market Research: Market research was conducted by utilizing web-based market research and a comparison of potential solutions to VA Cybersecurity requirements.

Market Research has been continuous and the follow on is currently being competed.

On June 18, 2025, the Government contract specialist posted a RFI on SAM.GOV under North American Industry Classification System (NAICS) code 541512, Computer Systems Design Services. The RFI closed on June 25, 2025, with eight (8) responses including: four (4) SDVOSBs, one (1) Veteran-Owned Small Business (VOSB), one (1) Small Business, one (1) Large Business, and one (1) unknown company size.

Responses were reviewed by the VA SME(s) and multiple resellers were found capable of providing the required services, however, no vendor can immediately onboard support staff and resume support without severely impacting existing services. A new task order was solicited on August 26, 2025, and is anticipated to be awarded in late October 2025.

9. Other Facts: None

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the modification to extend contract VA118-16-D-1025 36C10B24N10250027 on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.