Brand Name Justification FireEye_Redacted.pdf

Control Number VA-21-00070882

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement Acquisition and Logistics Technology Acquisition Center (TAC)

23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: This proposed action is for a firm-fixed-price (FFP) delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name FireEye, Inc. (FireEye) malware protection appliances, software licenses, warranty and maintenance support.

3. Description of the Supplies or Services: The VA Office of Information Technology (OIT), Service Delivery and Engineering, End User Operations (EUO) has a requirement to acquire brand name FireEye malware protection appliances, software licenses, warranty and maintenance support. FireEye is required for 8 VA locations inclusive of Regional Data Centers and Information Technology Centers. FireEye provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks. Brand-name FireEye hardware, software, warranty, and maintenance support is required to expand EUO's existing malware monitoring architecture and infrastructure. The period of performance shall be 12 months from the date of award, with two 12-month option periods to maintain warranty and maintenance support. All hardware will be installed in the base period.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on extensive market research, as described in paragraph 8 of this document, it was determined that limited competition is viable among resellers for the brand name FireEye malware protection appliances, software licenses, warranty and maintenance support. No other malware protection appliances are interoperable or compatible with the existing FireEye-based malware protection systems and architecture due to the proprietary operation of the FireEye software and underlying proprietary microcode and protocols for FireEye appliances. Currently, Fire Eye is purchased and utilized throughout VHA, however additional Fire Eye licenses are required for expansion of this system to support EUO as throughput is not large enough for the increase of COVID traffic and an increased

Infrastructure Operations Brand Name FireEye Malware Protection Appliances, Software License, and Maintenance Support Services dependency on virtual and remote working. Therefore, EUO requires an increase in throughput to protect all traffic. The current appliances and associated software communicate through a proprietary source code, and no other software can provide this communication capability without this proprietary source code. Specifically, only FireEye security appliances can provide upstream forwarding of any localized malware activity data into the existing FireEye architecture. The upstream forwarding of malware data produces a single collective view of the status of all security-related activity over the network and displays the security posture of all elements operating on the network. No other brand name hardware and software appliance can accomplish this functionality, because no other product can communicate or integrate with the existing FireEye architecture, infrastructure and licensing with the single collective view Infrastructure Operations (IO) Console, and thus will not allow monitoring and visibility of malware activity on the network.

While other devices such as International Business Machines (IBM) Security Network Intrusion Prevention System, Cisco lronPort, and Palo Alto Wildfire provide malware protection and monitoring, no other products are interoperable with IO's existing FireEye architecture. Therefore, no other product can operate and meet VA’s current requirements. Additionally, data monitoring and malware activity captured by another vendor will not integrate with the existing IO FireEye infrastructure components. Due to these proprietary constraints, the use of any alternative solution would necessitate the complete replacement of the FireEye infrastructure in place. VA technical experts estimate that the duplicative cost to pivot to an alternative solution would cost a minimum of $6.5 million and would require 24 months to implement the changeover.

These estimates are based on previous acquisition history. These estimated duplicative costs would not be recovered through competition.

Additionally, the required software licenses, warranty and maintenance support, which consists of software updates, firmware updates, patches, and defect support can only be provided by FireEye or an authorized reseller. FireEye software is proprietary; no other vendor can access the necessary source code or capability to perform fixes and updates of the FireEye products. The proprietary source code is not available to third-party vendors; therefore, no other vendor other than an authorized reseller can provide the required software and firmware updates for FireEye products. Specifically, failure to procure these licensing and maintenance support would negatively impact VA’s response capabilities to cyberattacks, which would have disastrous impacts to Veteran’s information security, VA initiatives, and ability to provide care to Veterans.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name FireEye software maintenance and technical support. In accordance with FAR 5.301 and 16.505(b)(2), this action will be synopsized within 14 days of award on the Contracting Opportunities Page on sam.gov and the justification will be made publicly available. In addition, in accordance with 16.505(a)(4(iii)(A), this

Justification for an Exception to Fair Opportunity will be posted on the NASA SEWP V website with the solicitation.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the agency will work with the program office to continue to perform market research to consider and ascertain if any other sources can provide these services in the future.

8. Market Research: Market research efforts were conducted by VA subject matter experts in June 2021 via web-based research. VA’s technical experts reviewed products offered by similar manufacturers, specifically IBM Security Network Intrusion Prevention System, Cisco lronPort, and Palo Alto Wildfire. However technical experts concluded that none of these products can meet the Government’s interoperability requirements.

Specifically, due to the proprietary nature of the hardware and software no other alternative vendor has the proprietary rights to access FireEye architecture nor could any other software communicate with FireEye due to its proprietary software protocols.

Additionally, no other software developer has the intellectual property rights to access and modify the FireEye source code, provide the malware protection appliances, software licenses, and warranty and maintenance support.

Additionally, in June 2021 the TAC conducted market research by using the Provider Look Up Tool on the NASA SEWP V GWAC website. The tool revealed multiple resellers of FireEye malware protection appliances, including multiple verified Service- Disabled Veteran Owned Small Business (SDVOSB) resellers. Additionally, NASA SEWP V GWAC has a dynamic catalog where line items can be added based on customer requests; therefore, as long as the required item or service is within scope of the NASA SEWP V GWACs, items and services can be added to a NASA SEWP V GWAC holder’s catalog on a daily basis. Therefore, based on the results of the market research, there is reasonable expectation that limited competition exists among verified SDVOSBs.

9. Other Facts: N/A

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable. Contracts awarded on NASA SEWP V GWAC have already been determined to be fair and reasonable. Price competition is anticipated as there are multiple potential vendors on NASA SEWP V GWAC. Finally, the successful quote will be compared to the Independent Government Cost Estimate.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name FireEye malware protection appliances, software licenses, warranty and maintenance support, on an other than full and open competition basis pursuant to the statutory authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.