C01 Final JA FireEye Hardware Maintenance-6.10.21_Redacted.pdf

Control Number: 21-00053030

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center

1701 Directors Blvd.

Austin, TX 78744

2. Description of Action: This proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name FireEye hardware maintenance coverage for the Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Information Technology Operations and Services (ITOPS), Infrastructure Operations (IO) Data Centers at the VA.

3. Description of Supplies or Services: The Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Information Technology Operations and Services (ITOPS), Infrastructure Operations (IO) Data Centers at the VA has a requirement for brand name FireEye security product hardware maintenance.

FireEye products protect networks against known and unknown advanced malware attacks with Yara rules and signature-less Multi-Vector Virtual Execution engines.

FireEye is a behavioral-based malware protection system and can detect and block malware from penetrating the network. The required FireEye brand hardware maintenance will consist of immediate problem escalation to level three FireEye Advanced Support Engineering experts, unlimited number of designated VA callers and secure support website/portal access, and repair or replacement of equipment components that restore systems to full operation and accessibility to the original redundant component configuration. The hardware maintenance also includes services 24 hours a day, 7 days a week, 365 days per year; initial response to all requests for maintenance within one (1) hour of the initial notification from VA;

firmware upgrades, updates to include major releases, point releases, service releases and security releases of applicable firmware on a quarterly basis, and/or within 48 hours in cases where a high risk vulnerability fix becomes available. The required hardware maintenance is necessary for IO to be able to prevent malware attacks against the VA network by ensuring the existing FireEye hardware remains operational. The period of performance shall be from September 28, 2021 through September 27, 2022 and two (2) 12-month option periods with an estimated price of

4. Statutory Authority: The statutory authority permitting this exception to fair opportunity is Section 41 U.S.C 4106(c)(2) as implemented by Federal Acquisition Regulation (FAR) Section 16.505(b)(2)(i)(B) entitled, “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

FY21 FireEye Hardware Maintenance Control Number: 21-00053030

5. Rationale Supporting Use of Authority Cited:

Based on market research, as described in paragraph eight (8) of this justification, it was determined that limited competition is available among authorized resellers of FireEye products and services for the aforementioned maintenance support. This is a brand name justification in accordance with FAR 11.105, Items Peculiar to One Manufacturer. Only FireEye brand network security monitoring hardware maintenance will fulfill the Government’s requirements for FireEye maintenance services due to the proprietary nature of the hardware. A non-FireEye service provider would not be able to provide the appropriate hardware maintenance activities because only FireEye services providers will be able to access the proprietary data and information to acquire and implement specific revision upgrades and replacement equipment. If any alternative service provider was to be utilized, it would necessitate the complete replacement of the brand name FireEye infrastructure in place. Such a replacement effort is estimated to cost approximately and would take approximately 18 months to accomplish. These estimates are based on previous acquisition history and on previous implementation experience. These duplicative costs would not be expected to be recovered through competition.

Failure to procure the required brand name FireEye hardware maintenance coverage would compromise VA’s ability to protects against hundreds of malicious network and system cybersecurity activities. FireEye is also a primary visibility point for existing production automated threat response and containment processes across other production cybersecurity infrastructure within data centers and across the enterprise. Without continuation of the required maintenance coverage, the protection FireEye provides against VA system and VA data compromise in support of continued VA systems providing veteran benefit and services would be hampered leading to potential harm and cessation of Veteran services.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this justification. This effort did not yield any additional sources that could meet the Government’s technical requirements. It has been determined however that limited competition is viable among authorized resellers for the brand name requirements specified herein who are current NASA SEWP V GWAC holders. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the beta.SAM.gov Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be fully competed.

FY21 FireEye Hardware Maintenance Control Number: 21-00053030

8. Market Research: Market research was conducted in March 2021 via web-based research where the Government’s technical experts reviewed similar hardware products to ascertain if these items could meet VA’s requirements. Specifically, the Government’s technical experts reviewed alternative solutions from vendors including Blue Coat, Source Fire, and Trend Micro. As a result of the market research the technical experts confirmed that no other alternative vendor solution would have access to the FireEye source code as the source code required to issue the updates are proprietary to FireEye Inc. Based on these findings, the Government has determined that currently, only FireEye or its authorized resellers can provide the required level of support for the existing FireEye brand equipment.

Only FireEye and authorized resellers are capable of accessing the proprietary data and information necessary to provide the required maintenance support for the existing hardware.

In addition, the contract specialist (CS) conducted market research in May 2021 by using the NASA SEWP V GWAC Provider Lookup Tool to determine what vendors are capable of providing the full requirement. Based on this market research, the CS identified multiple resellers within NASA SEWP able to provide the required brand name products.

9. Other Facts: None.