JA - TIC Application Firewall - Redacted.pdf

TIC Application Firewall Maintenance CONTROL NUMBER VA-27-00009587

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement Operations Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order to be issue under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for the renewal of brand-name Thales Luna Hardware Security Module (HSM) license subscriptions and associated maintenance support for the Trusted Internet Connection (TIC) Gateway 7080 Application Firewall solution.

3. Description of the Supplies or Services: VA’s Office of Information and

Technology, Connectivity and Collaboration Services, Network Core Services, requires the renewal of brand-name Thales Luna HSM maintenance support and license subscriptions supporting the TIC Gateway Application Firewall solution. The existing VA TIC Gateway Application Firewall environment uses Thales Luna HSMs to provide enhanced Layer 7 security for network traffic entering and leaving VA networks. This existing VA TIC Application Firewall solution provides enhanced layer 7 security for network traffic flowing into and out of VA. VA requires the renewal of its existing Thales license subscriptions and maintenance support for the following Thales products: eight (8) production Thales Luna HSMs and two (2) non-production Thales Luna HSMs to ensure users have secure and safe network access to applications, files, protection against viruses, spam and malware while continuing to seamlessly integrate with other existing components of the TIC infrastructure.

Two production Gateway Application Firewalls are deployed across four Internet Gateway locations in Sterling, Virginia; Dallas, Texas; Chicago, Illinois; and Santa Clara, California. Two non-production laboratory firewalls are located at the Capitol Region Readiness Center in Martinsburg, West Virginia. Required maintenance support required shall include 24x7 technical support, hardware replacement, and access to applicable software patches and upgrades. No hardware will be procured under this requirement. The Period of Performance (PoP) shall be November 24, 2026, to November 23, 2027, with two (2) 12-month Option Periods to be exercised at the Government’s discretion. The total estimated value of the proposed action, including all option periods, is

4. Statutory Authority: This brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by Federal Acquisition Regulation (FAR) Overhaul VA Deviation 16.507-6(b)(2), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8, VA has determined that only brand name Thales Luna HSM license subscriptions and maintenance support will meet VA’s requirements at the level of quality required to support VA’s existing TIC Gateway Application Firewall solution. VA currently utilizes a solution comprised of Thales brand hardware to meet its requirements for the TIC Gateway Application Firewall. This procurement will provide maintenance and license support for the Thales Luna HSM components of this firewall solution currently employed by VA. The brand name Thales Luna HSM license subscriptions and maintenance support are required because the existing firewall is managed by a central Thales application which interfaces with VA’s existing visibility and monitoring tools, security information and event management tools and advanced security and analytics tools. The Thales application’s ability to interface with the aforementioned existing VA tools renders it highly specialized. In addition, VA has also built custom security monitoring and alerting tools that are based on the Thales platform. This proprietary advanced endpoint protection includes malware and exploit prevention methods. This solution provides VA management with critical information on active and potential threats to VA networks. Failure to renew the license subscriptions and maintenance support for VA’s existing TIC Gateway Application Firewall solution, comprised of Thales Luna HSM, will reduce the functionality of the existing application firewall enterprise system and present significantly increased security risk to VA networks to include the loss of sensitive Veteran data.

Thales is an original end manufacturer (OEM) of specialized information technology equipment. Thales’ products are proprietary in nature and are embedded with source code which prevents unauthorized third parties from accessing and tampering with copyrighted products. Only Thales and their authorized resellers have access to its own source code. Access to the source code is required to make any changes or updates to its copyrighted products. No other sources can provide the necessary hardware/ firmware updates, patches, licenses, maintenance, access to the latest security threat database and defect support because of the proprietary nature of its appliances and software. Only Thales and their resellers have access to their respective proprietary source code which is required to troubleshoot, diagnose and manage the hardware, software and appliances furnished by the OEM. No other OEM has access to the source code in order to provide the license renewals and maintenance services required by VA.

Further, replacing the existing firewall with any other solution will require a complete replacement and re-engineering of VA’s existing TIC Gateway Application Firewall solution. During this time, VA would still need to continue to maintain and upgrade existing Palo Alto Networks (PAN) hardware for the TIC Gateway Application Firewalls until such time that a potential new solution would be in place. The costs associated with replacing the existing application firewall solution is estimated to be in excess of which is based on previous acquisition history completed by VA and would not be recovered through competition. Additionally, there would be a significant increase in risk to VA information systems during any such re-engineering effort. It is estimated that a minimum of 2,880 hours (or approximately 18 months) of senior level engineering time would be required to duplicate the functionality of the current firewall architecture using a different vendor’s solution, during which time significant security functions could be periodically unavailable to VA information security teams and information systems security officers as VA transitions, troubleshoots and calibrates a new firewall solution. During these periodic gaps in firewall functionality VA end-users and assets will be vulnerable to possible known and unknown cybersecurity breaches and threats. This solution is a critical enterprise component of the TIC Gateway, which provides data loss prevention by detecting and avoiding data breaches for the destruction of Veteran’s sensitive data. Therefore, only Thale’s license subscription renewals and maintenance support will meet VA’s requirements for this effort.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that could meet the Government's requirements.

However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name licenses, as well as software maintenance and support. Furthermore, in accordance with RFO VA Deviation 5.301 and 16.507-7(c)(1)(i), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to learn if there are changes in the marketplace that would enable future actions to be completed.

8. Market Research: VA’s technical experts conducted market research in

June 2026 via internet research and reviewing online industry publications of other network firewall hardware and software maintenance providers to ascertain if any other manufacturer would satisfy VA’s requirements.

Specifically, VA technical experts conducted web-based market research using open-source search engines, vendor website searches and review of non-Thales vendor maintenance specifications, datasheets and white papers looking for products capable of supporting VA’s TIC Gateway Application Firewall solution. Vendor applications and product lines researched included FortiClient, nShield General Purpose HSM, Microsoft Defender for Internet of Things, Data Security Manager and Waterfall Security Solutions Unidirectional Security Gateway. VA technical experts analyzed these competitors’ capabilities and determined that they do not have access to proprietary source code required to troubleshoot and diagnose the Thales Luna HSMs to ensure the services provided to the hardware components of VA’s existing TIC Gateway Application Firewall solution are properly configured and meet VA’s security needs. Thales and its authorized resellers can provide the license subscriptions and maintenance support for its appliances, which are capable of meeting the requirements for deployment and support of VA’s TIC Gateway Application Firewall solution.

The Office of Strategic Sourcing conducted market research on NASA SEWP V GWAC via a Request for Information (RFI) beginning August 10, 2026, and closing on August 17, 2026. Five (5) vendors provided responses to the RFI. Responses included one Service-Disabled Veteran- Owned Small Business (SDVOSB), two Woman-Owned Small Business, and two Other than Small Business. All respondents were capable of providing Thales Luna HSM maintenance services.

The Contract Specialist conducted additional market research in September 2026 by utilizing the Provider Lookup Tool on the NASA SEWP V GWAC website to determine if the brand name Thales license subscription renewals and maintenance support are available. The search revealed that there are 69 Thales resellers, including 21 approved reseller SDVOSBs capable of meeting the requirement. Furthermore, NASA SEWP has a dynamic catalog where line items can be added based on customer requests provided that the required item or service is within the scope of the NASA SEWP V contract suite and therefore additional competition may be achieved.

Based on the results of the review set forth above, there is reasonable expectation that two or more SDVOSBs will be able to provide the required brand name Thales license subscription renewal and maintenance support. Therefore, given that there is a reasonable expectation of competition between at least two capable SDVOSBs, it has been determined by the Contracting Officer that the subject Request for Quotation will be released as a SDVOSB set-aside under the existing

NASA SEWP V contract vehicle, under the Value-Added Reseller NAICS code 541519.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on NASA SEWP V contract pricing that has already been determined to be fair and reasonable. In addition, price competition is expected amongst the NASA SEWP V contract holders which will further establish fair and reasonable pricing.

Finally, price analysis shall be conducted by comparing the successful quote with the Independent Government Cost Estimate.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. This contract action exceeds the simplified acquisition threshold, but does not exceed $750,000, therefore, the certification required by FAR 16.505(b)(2)(ii)(A) serves as the Contracting Officer’s approval.