C01 - JA-CyberArk-FY25 CO Redacted.pdf

CONTROL NUMBER VA-25-00038625

JUSTIFICATIONFOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-priced task order issued under the National Aeronautics and Space Administration (NASA), Solutions for Enterprise-Wide Procurement (SEWP) V, Government-Wide Acquisition Contract (GWAC) for brand name CyberArk Software Ltd. (CyberArk) Core Privileged Access Security (CorePAS) maintenance support services for existing CyberArk perpetual licenses.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information Technology Information Technology Operations and Services, Infrastructure Operations, Cybersecurity Management requires renewal of maintenance support services for 1,000 each CyberArk Privileged Access Security (PAS) Solution, and Application Access Management existing perpetual licenses, and 6 Central Policy Manager (CPM), 1 PAS Disaster Recover, 1 Application Dynamic Provider software maintenance. VA’s Continuous Readiness Information Security Program (CRISP) requires the security of all privileged accounts human and nonhuman. Using automated privileged authentication provides enforcement of access to accounts and/or passwords preventing privileged escalation and the ability for users/attacker to move laterally through VA systems. Cybersecurity Executive Order 14028, Federal Zero Trust Architecture Office of Management and Budget Memorandum 22-09 and VA’s CRISP requires system security monitoring of all privileged user accounts, and the routine rotation of privileged accounts and systems credentials. As such, VA requires a solution which provides access control through brokering of privileged user accounts to remote systems as well as account password management for Windows, *NIX, Mainframe zOperating System, and Resource Access Control Facility, application, database, and network devices. VA currently uses CyberArk software to automatically rotate passwords to meet VA’s policy, National Institute of Standards and Technology (NIST) 800-53, and industries standards. VA also requires the ability of auto-discovery of privileged credentials and hard-coded passwords. Requirements to maintain VA’s applications operation and availably for Veterans, requires minimum downtime. VA requires secure credentials and automated password rotation per policies in order to keep applications operational for Veterans. CyberArk software provides the VA required real-time auditing and monitoring of privileged access. VA requires renewal of maintenance support services which includes 24/7 telephone and email support, software updates, patches, and defect support. 1 Central Policy Managers (CPM) for 7 months 23 Jun 2024 – 29 Jan 2025. In addition, for 1,000 CyberArk Users Licenses, 1 vault and Disaster Recovery (DR), 6 Central Policy Managers (CPM), 1,000 Central Credential Provider and/or Dynamic Access Provider agents for base year 30 Jan 2025

– Jan 29 2026. Then with one, 12-month option periods to continue maintenance and support. The total estimated value of the proposed action is

CyberArk (PAS) Renewal and Maintenance Control Number VA-25-00038625

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: VA requires support that is compatible with the existing CyberArk PAS solution which are proprietary products.

Renewal of maintenance support services is required to reduce Federal Information System Modernization (FISMA) Audit associated with NIST Notice of Findings and Recommendations security controls. Failure to comply with these findings and recommendations could expose privileged user accounts within the VA to increased cybersecurity risks. The maintenance renewal for the CyberArk brand will allow the VA to continue critical operations and remediate a critical risk exposure to administrative user accounts that would manifest should this contract not be approved.

CyberArk brand name software is the only software that can seamlessly build upon Cybersecurity Management’s existing CyberArk Privileged Access Security Solution ecosystem that current contains the following inflight solutions: (1) CyberArk Enterprise Password Vault, (2) CyberArk Privilege Account Management and (3) Application Access Manager (FF). CyberArk software provides required real-time auditing and monitoring of privileged access. No other brand name elevated privilege account auditing, tracking and password vaulting system has been determined to be interoperable or compatible with the currently fielded CyberArk architecture including servers, software, accounts, and interfaces. Specifically, the system and software communicate through a source code that is based on CyberArk proprietary data. No other software can provide this communication capability without this source code. In the VA’s current architecture, only CyberArk brand name security appliances can provide upstream forwarding of any localized elevated privilege account auditing, tracking and password vaulting data into the existing IO Cybersecurity Management’s SIEM architecture. The upstream of data is critical to produce a single view collective status of all elevated privilege account auditing, tracking and password vaulting related information localized in a system or over the network. This will ultimately provide VA a single interactive view that displays the monitored VA’s user, system and network’s security posture of all elements of Information Technology protection. Furthermore, any other brand name software cannot accomplish this because another product cannot communicate, nor integrate with the architecture and licensing of, the Enterprise Operations Security’s Console, and thus will not allow security visibility of elevated privilege account auditing, tracking and password vaulting activity on the network.

Additionally, elevated privilege account auditing, tracking, and password vaulting by another vendor will not integrate with the existing toolset. No other vendor has the ability or data rights to access the existing CyberArk software source code in order to develop and push software updates, patches, or provide technical support on its products.

Access to the proprietary source code is critical to meet the VA's need. Due to these proprietary constraints the use of any other software would require a complete replacement of the CyberArk architecture currently in place including the replacement of 170 servers, the transition of 20 thousand plus privileged human and non-human accounts and passwords from one proprietary Privileged Access Security (PAS) Solution to another, and the development and configuration of interfaces from the PAS solution to VA applications for secure connections to endpoints meeting multiple NIST 800-53 controls. Based on previous acquisition history, this replacement of the current infrastructure would result in estimated duplicated costs of over and would require 36 months to implement. These estimated duplicative costs would not be recovered through competition. Failure to renew the maintenance services for the licenses would cause catastrophic damages to VA as there would not be a solution in place which would have the required administrator rights or permissions necessary to repair and/or restore accounts as a result of unauthorized access or other performance related issues. This could result in work stoppage for VA applications that include programs utilized for patient care such as pharmaceutical application that communicate to outside pharmacies, and a VA’s medical facility blood bank application that communicate to the surgery rooms, so they know how much blood is oh hand.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the Section 8 of this document. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name CyberArk license maintenance support services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government’s subject matter experts (SME) conducted market research by reviewing other similar elevated privilege account auditing, tracking, and password vaulting systems. This market research is an ongoing process that started in 2015. The other similar software reviewed included Quest, BeyondTrust, and Centrify Software. Based on reviews of these products, the Government’s technical experts determined that none of these products can meet the Government’s technical, interoperability, and compatibility requirements previously discussed.

As a result of the market research the technical experts confirmed that, as the source code required to leverage the existing CyberArk Privileged Access Security Solution ecosystem that currently exists in VA. Further, the other products reviewed cannot communicate or cannot become interoperable or compatible with the currently fielded

CyberArk architecture due to the proprietary nature of the source code. Finally, no other source can issue updates due to the proprietary nature of the software. CyberArk is the only source capable of providing the required software maintenance and upgrades for CyberArk software. No other firm has the capability of developing and issuing software updates and fixes for the CyberArk software necessary to support existing IO requirements. Additionally, VA SMEs regularly reviews industry trade publications and conduct internet research to ascertain if any other brand name software is available.

Based on all these market research efforts, the Government’s technical experts have determined that only CyberArk brand name license maintenance support services can meet all of VA’s needs.

Further, the Contract Specialist (CS) conducted market research in January 2025 utilizing the NASA SEWP V GWAC market research tool to determine which contract holders can meet the requirement. Based on this market research, the CS found multiple Service-disabled Veteran-owned Small Businesses (SDVOSBs) capable of meeting the full requirement. The NASA SEWP V GWAC has a dynamic catalog where line items can be added based on customer requests. Therefore, if the required item or service is within scope of the NASA SEWP V GWAC, items and services can be added to the catalog daily. These requirements have been found to be within scope of the NASA SEWP V GWAC by the Contracting Officer. As such, VA intend to issue a Request for Quotation as an SDVOSB set-aside via the NASA SEWP V GWAC under NAICS 541519 to Groups B, C and D.

9. Other Facts: None

10. Technical/Requirements Certification