S02- Attachment A_JA Prisma Cloud Renewal_FINAL_Redacted.pdf

Brand Name Prisma Cloud Compute Edition software licenses renewals and premium success support | Control Number: VA-25-00011823

JUSTIFICATIONFOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for Brand Name Prisma Cloud Compute Edition software licenses and premium success support for the office of Benefits and Memorials Services (BAM).

3. Description of Supplies or Services: The VA Office of Information and Technology (OI&T), Product Delivery Service (PDS), Benefits and Memorials Services (BAM) Portfolio has a requirement to procure a renewal of annual subscriptions, Brand Name Palo Alto, Prisma Cloud Compute Edition software licenses and premium success support for the Benefits Integration and Administration (BIA) Product Line, including;

Benefits Integration Platform (BIP) and Benefits Enterprise Platform (BEP) which are both considered Bedrock systems for the VA. The procurement will include 4,230 software license renewal for Prisma Cloud Compute as well as Premium Success Support for US Government accounts to provide a common Cloud Native Application Protection Platform (CNAPP) solution for BIA products as well as BIP hosted tenants services aligned to the Enterprise Management of Payment Workflow and Reports (eMPWR- VA), Memorial and Benefits Services (MBS), Benefits Integration Administration (BIA) and Compensation and Pension (C&P) Product Lines, including critical system such as Veterans Benefits Management System (VBMS) to provide near real time security scanning and reporting capabilities for infrastructure hosts, applications, container images and serverless functions, in a single pane of glass. The VA requirements are as follows:

• The VA, BIA Product Line requires a Cloud Native Application Protection Platform solution that can either be hosted on VA servers (on-prem) or is a Federal Risk and Authorization Management Program (FedRAMP), High Software as a Service (SaaS) offering. Furthermore, on-prem solutions must have a pathway for Technical Reference Model (TRM) approval.

• The VA, BIA Product Line requires support US only vendor support for

Commercial Off The Shelf (COTS) products that are hosted by VA servers as well as container management solutions offered as services by cloud vendors.

• The VA requires an easily scalable solution due to the growing use of BIP as a container-based environment as well as accommodate for the larger needs of the BIA Product Line including BEP for near real-time host and serverless function scanning.

• The VA, BIP Product requires centralized view and control to view and address findings and risks across cloud, Kubernetes clusters, hosts and containers to ensure visibility into vulnerabilities for all Products/Systems hosted in support of the Authority to Operate (ATO) for BIP as well as BEP.

• The VA, BIA Product Line requires that the solution can collect and route findings with customized rules and Role Based Access Control (RBAC) to the appropriate Product Line, Product and specific system so that aligned system owners are able to properly address findings and maintain their systems and associated tenant assessment packages.

• The VA, BIA Product Line requires that the CNAPP solution is able to integrate with multiple industry standard solutions already in use at the VA, including Atlassian Jira for automated ticket creation of findings that can be aligned to the appropriate product line and product team backlogs.

• The VA, BIA Product Line requires that the CNAPP solution at a minimum uses the Common Vulnerability Score System (CVSS) v3.1 scoring schema that can be mapped to VA Service Level Agreements (SLA) for remediation as defined in the VA 6500.

• The VA, BIA Product Line requires that the solution can identify when a vulnerability is first identified in the given environment to support alignment to VA defined SLAs for remediation.

• The VA requires that the solution supports the ability to export detailed reports into comma separated values (csv) format so that the data can be used for custom analysis and reporting and support the ability to import the data into critical VA tools such as eMASS to maintain ATO packages and Information Central Analytics and Metrics Platform (ICAMP).

• BIA BIP Product requires the ability to maintain requirements for Continuous

Integration/Continuous Deployment (CI/CD) pipeline vulnerability scanning in order to remain on track with Zero Trust Architecture Mandate M-22-09 compliance.

• The VA requires that the solution provides automated runtime security for running containers as well as automated alerts when suspicious runtime activity is identified, in real-time without manual intervention. The solution must also provide an easy-to-configure rule set that allows for global or fine-grained application of security policies to enable seamless transitions from alerting to prevention in pursuit of increasing the Zero Trust Architecture Mandate M-22-09 compliance.

• The VA requires that the solution supports Web Application and API Security

(WAAS) to protect both web-based applications hosted on hosts and containers from a range of attacks, including but not limited to: SQL injection, Cross-site scripting (XSS), Malformed request protection, etc. The solution must also support API traffic security enforcement based on OpenAPI specifications.

• The VA requires that the CNAPP solution support default (out-of-the box) and customizable protection of filtering and scrubbing of sensitive information, such as Personally Identifiable Information (PII), from runtime events to ensure that sensitive information is excluded from runtime findings, including forensic data, incident reports, and audit logs.

These capabilities are critical to the continuation of modernization efforts across the BAM portfolio, ensuring adherence to VA vulnerability remediation service level agreement (SLA) and ensuring that product teams meet the Presidential Executive Order to adopt and mature adherence to Zero Trust Architecture (ZTA).

The period of performance will be a 12-month base period from February 1, 2025 to January 31, 2026 and also includes two (2), 12-month option periods and two optional tasks for additional licenses. The optional tasks will provide additional licenses to support the future growth of new tenants joining BIP. The total estimated price for the proposed action is .

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is available among resellers for the required brand name Prisma Cloud-Compute Edition software developed by the Original Equipment Manufacturer, Palo Alto, Networks, Inc.

The Government requires a single container scanning solution that can be utilized across BIA Products. Brand name Palo Alto Prisma Cloud-Compute Edition software meets the VA requirements and incurs the least amount of impact, implementation timeline and costs

The brand name Prisma Cloud Compute software has been in use on the BIP product since 2020 and is integrated into over 90% of our CI/CD Pipelines across 52+ tenants aligned to 4 products lines in the BAM Portfolio including Compensation and Pension

(C&P), Memorial Benefits Services (MBS), Benefits Integration Administration (BIA) and Education Veteran Readiness Employment (EVRE). A transition in tooling solution would incur significant risks (as described below), additional cost of and an impact to delivery timelines across all listed product lines. Consequently, Brand name Prisma Cloud-Compute Edition software by Palo Alto, Networks is the only software that met all the requirements, provided parity for current capabilities in one solution and results in the least amount of time and technical resource costs to implement. If Prisma Cloud Compute is not procured the VA BIA Product Line would have to combine multiple open-source solutions or combine open-source with COTS solutions to arrive at an equivalent solution as Prisma Cloud Compute Edition. The BIP Product team estimates if brand name Prisma Cloud Compute Edition software is not purchased, that acquiring, integrating, and implementing other individual software solutions would require an additional twelve (12) months across 2 scrum teams which would mean a loss of current functionality for container scanning and vulnerability insight across BIP. This will result in numerous downstream negative impacts on the delivery schedules for PACT Act initiatives and architectural improvement modernization plans for the Veterans Benefits Administration services such as Veterans Benefits Management System , Work Queue, Data Sync, VA Profile and Records Resource Center aimed to increase claim accuracy, reduce claim cycle time through the ability to leverage real-time data to inform decisions regarding enrollment, eligibility, patient care and billing which will have direct and negative impact on Veterans and their families. Additionally, to implement an alternative solution will result in duplicative costs of to replace software products and services.

Furthermore, if Palo Alto Prisma Cloud-Compute Edition software is not acquired, VA will be unable to fully meet visibility to Known Exploited Vulnerabilities (KEVs) compliance requirements of Cybersecurity and Infrastructure Security Agency (CISAs) Binding Operational Directive (BOD 22-01- Reducing the Significant Risk of Known Exploited Vulnerabilities). Failure to procure the required brand name software would result in disruption to current Information Assurance (IA) processes for a minimum of 4 Product Lines under the BAM Portfolio and will result in a gap in ability to observe and address vulnerabilities in near-real time. Failure to procure this brand name software will also delay BIA’s progress in meeting the Zero Trust Architecture Mandate (M-22-09) and lastly, compromises VA Systems and Veteran data.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, it was determined that limited competition is available among resellers for this brand name requirement. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation on the NASA SEWP V GWAC website for review by all prospective offerors.

Furthermore, in accordance with FAR 5.301 and 16.505(b)(2) notice of award of this action will be synopsized on the sam.gov website within 14 days of award and this justification will be make publicly available.