C01 Equinix eCloud Svcs - JA - FAR Part 8 for Mod_Rev 5 20 2020_Redacted.pdf

Equinix eCloud Services VA-20-00064957

LIMITED-SOURCES JUSTIFICATION

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Acquisition Operations

Technology Acquisition Center 1701 Directors Blvd

Austin, TX 78744

2. Description of Action: The proposed action is an out-of-scope modification to the existing order umber 36C10A18F0630 under General Service Administration (GSA) contract GS-35F-401BA for closed cabinet rack space, single phase primary and redundant power, and fiber circuit interconnection in both Chicago and Ashburn Veterans Affairs (VA) gateway facilities. The order was awarded on September 26, 2018, as a twelve (12) month firm-fixed price (FFP) task order, with two 12-month option periods, and the first option period is currently being performed. This is a sole source action conducted under the authority of the Multiple Award Schedule Program; the proposed effort will be awarded under the General Services Administration (GSA) Federal Supply Schedule (FSS) GS-35F- 401BA to Equinix, Inc., One Lagoon Drive 4th Floor, Redwood City, CA 94065- 1562.

3. Description of the Supplies or Services: The original order provided interconnection to cloud services, such as Microsoft Exchange Cloud, Amazon Web Services, and ServiceNow, at VA facilities located in Chicago, Illinoise,and Ashburn, Virginia, in accordance with the Federal Cloud Computing Strategy, and comply with Department of Homeland Security (DHS) Trusted Internet Connection (TIC) and Office of Inspector General (OIG) requirements for encrypted electronic communications. Modification P00002 extended cloud access capabilities for West and South gateway facilities, located in San Jose, California, and Dallas, Texas, respectively. This modification seeks to add virtual circuit connections at East, South, and West locations in support of redundancy, failover, and improved network performance for enterprise-wide traffic connecting to ServiceNow.

TIC requirements, as described by TIC Reference Architecture version 2.0, describes “security patterns” and related functions for communications, as they relate to specific connection types. Mandatory security functions for “External Connections” include the implementation of packet filtering, content filtering, intrusion detection and prevention, as well as the use of proxy connections for all communications. OIG requirements are based upon findings summarized by report number 12-02802-111 “Review of Alleged Transmission of Sensitive VA Data Over Internet Connection”, and the subsequent response from the VA Assistant Secretary for Information and Technology (AS/IT). In summary, the report references several regulations which require VA encryption of PII data including, FIPS 140-2, VA Handbook 6500, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). As summarized in the report, the VA

Equinix eCloud Services VA-20-0000000 uses Multiprotocol Label Switching (MPLS) which is supported by carriers . The carrier MPLS networks do not inherently employ encryption; however, they do offer a segmentation of network traffic to differentiate between private networks from Internet connections. TIC requirements define security patterns for external connections, while OIG recommendations with corresponding AS/IT concurrence, defines unique encryption requirements for such defined external connections. In order to meet both operational goals for connectivity to cloud service providers and remain compliant with regulations for encryption, an intermediary service provider is necessary. A intermediary service provider will allow for the use of VA-owned equipment for regulatory requirements, and also have the capability to provide interconnectivity to various cloud resources.

The contractor shall provide virtual circuits at each of the following locations:

Ashburn, Dallas, and Silicon Valley. Specifically, the Ashburn, Dallas, and Silicon Valley, will be furnished with remote virtual circuits (VC) at each location.

As a result of the proposed actions, the VA will then have four pairs of geographically dispersed connections capable of providing virtual connectivity to ServiceNow resources, while benefiting from redundancy and failover capabilities. In addition, the contractor shall provide primary and redundant routing instances to support VCs that are limited to supporting Layer 3 peering.

The total estimated value of the proposed action modification, including the two 12-month option periods, is . This modification will result in the estimated total value of the effort increasing from to .

The period of performance for this modification will be date of award to 9/25/2020; and one 12-month option.

4. Authority: This acquisition is conducted under the authority of the Multiple- Award Schedule Program. The specific authority providing for a limited source award is Federal Acquisition Regulation (FAR) Part 8.405-6(a)(1)(i)(B), “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: The proposed source is Equinix, Inc., One Lagoon Drive 4th Floor, Redwood City, CA 94065-1562.

Service providers that currently deliver network communications for VA’s network are bound to restrictions that do not allow for both interconnectivity between cloud service providers, nor do they facilitate VA Network Operations to remain compliant with TIC and OIG requirements for encryption. While carriers do have reseller relationships with Equinix, Equinix is the only known service provider capable of offering connectivity to a wide array of cloud services while allowing compliance with TIC and OIG regulations. Equinix will allow the use of dedicated rack space for VA equipment to encrypt and decrypt traffic as required.

In addition, the proposed vendor has data centers within a few miles of VAs TIC facilities. This allows for low latency connectivity requirements to TIC facilities.

There are no known vendors who have facilities in locations with significant geographic dispersity. There would be high latency concerns without reasonable geographic dispersion. The VA has invested significant engineering and collaborative efforts between current service providers, in order to implement WAN solutions capable of minimizing latency-based impacts to communications.

As the One-VA WAN enterprise continues to meet cloud-based initiatives, it is likely most efficient to maintain operational advantages already achieved, as opposed to re-engineering comparable performance.

Furthermore, selection of another vendor exposes the VA to unnecessary costs for access to a number of other cloud services providers that current and future initiatives require, such as Amazon Web Services (AWS) and SalesForce. The VA has currently deployed solutions which interact with AWS with an associated cost for connectivity. By using the proposed vendor, VA could meet current operational requirements with no associated cost. If another vendor is selected, additional risk would be incurred as the new contractor’s staff may require a steep learning curve while gaining familiarity. These are all costs that would not be recovered through competition.

Equinix is the only provider able to meet the technical requirements necessary to ensure compliance with regulations while minimizing technical risk.

6. Efforts to Obtain Competition: Market research and outreach was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. There is no competition anticipated for this acquisition. In accordance with FAR 5.301 and 8.405-6(a)(2), this action will be synopsized at award on the Federal Business Opportunities Page (FBO) and the justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed. As cloud services mature, it is expected that more service providers will be able to offer solutions in accordance with TIC/OIG requirements as described.

8. Market Research: Market research efforts were conducted via direct outreach to several se·rvice providers to determine if competition was viable for this action.

A Request for Information (RFl)/Sources Sought notice was posted on GSA and FBO.gov from June 22, 2018 to June 29, 2018. No re-sponses were received on GSA eBuy. Three responses were received to the FBO.gov notice:

(Minority 9wned, Small Disadvantaged Business), (Veteran OwnedVOSB), and (Large

Business).The VA Contracting Officer Reprsentative (COR) reviewed the engine. The COR reached out to the one respondent to confirm their understanding of the RFI and that they would be unable to meet the requirement.

made no attempt to respond to the COR, and the lack of response lead VA technical experts to conclude that is unable to meet the requirement. There were no other responses to the RFI. Based on this market research, only Equinix is able to meet the requirement.

9. Other Facts: None.