C01 JA Final Palo Alto Wildfire Threat Protection - 7-19-21_Redacted.pdf

Control Number VA-21-00070905

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity: Department of Veterans Affairs Office of Procurement Acquisition and Logistics

Technology Acquisition Center 1701 Directors Blvd.

Austin, TX 78744

2. Description of Action: This proposed action is for a firm-fixed-price (FFP) delivery order (DO) to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name Palo Alto Wildfire & Threat Protection License Module software license subscriptions and maintenance in support of the Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Development Security Operations (DSO), Infrastructure Operations (IO) Security Management division.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Development Security Operations (DSO), Infrastructure Operations (IO) Security Management division has a requirement for six

(6) each Palo Alto Wildfire & Threat Protection License Module software license subscriptions to be perpetually assigned to the associated Palo Alto appliances. VA’s Federal Information System Management Act (FISMA) System Ownership and National Institute Standards and Technology (NIST) controls requires system security monitoring of all system logs and network connectivity to provide event and log correlation, event alerting and information security threat intelligence, automated integration, and reporting of all network intrusion attempt activity, to the IO data center Security Threat Module (STM) security infrastructure standard. Using combined STM Intrusion plug-in data feeds from Palo Alto, collectively referred to as Palo Alto brand name intrusion prevention capabilities meet these requirements. The intrusion prevention includes standard software and licenses. Finally, VA requires maintenance to begin once the six

(6) new Palo Alto Wildfire & Threat Protection License Module software license subscriptions are accepted; the required maintenance includes 24/7 telephone and email support, and updates for one year. The total period of performance includes a 12 month base period and two 12-month option periods. The total estimated value of the proposed action is , inclusive of all option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Palo Alto Wildfire & Threat Protection License Module software licenses is the only software that can continue to

Palo Alto Wildfire & Threat Protection Control Number VA-21-00070905 build upon cybersecurity’s existing Palo Alto based intrusion prevention system. Other brand name intrusion prevention solutions researched were unable to integrate with the currently fielded Palo Alto architecture and Palo Alto cybersecurity automated integrations in support of cybersecurity data orchestration. Additionally, no other brand name intrusion prevention system has been determined to be interoperable or compatible with the currently fielded Palo Alto based intrusion prevention system and Palo Alto brand name architecture and centrally managed licensing. Specifically, the current system and software communicates through a source code that is based on Palo Alto proprietary data. No other software can provide this communication capability without this source code. Existing Palo Alto brand name security appliance inventory includes existing ownership of 25 plus existing Palo Alto related appliances and licenses spread over VA data centers and medical centers. In addition to the VA’s continuous monitoring requirement, these intrusion prevention appliances are needed to support the VA’s Information Technology (IT) visibility to the network cybersecurity initiatives. Specifically, only Palo Alto brand name security appliances can provide upstream forwarding of any localized network intrusion activity data into the existing Palo Alto architecture. The upstream of data is critical to produce a single view collective status of all security related activity over the network. This will ultimately provide IO a single interactive view that displays the monitored IO’s network’s security posture of all network elements of malware protection. Furthermore, any other brand name software cannot accomplish this because another product cannot communicate, nor integrate with the architecture and licensing of, the existing Palo Alto Appliance Monitoring Console, and thus will not allow security visibility of malware activity on the network. Additionally, data monitored and provided by another vendor will not integrate with the existing toolset, vendor proprietary threat feeds which is based on Palo Alto brand name security architecture and licensing. Due to the proprietary constraints listed above, the use of any other vendor solution would necessitate a complete replacement of the existing brand name Palo Alto infrastructure in place. This replacement effort would take at least 24 months and require duplicative costs of approximately for replacement and the running of both systems in parallel during replacement. These estimates are based on previous acquisition history and these duplicative costs would not be recovered through competition.

Lastly, only Palo Alto or a reseller can provide the required maintenance of the Palo Alto Wildfire & Threat Protection License Module as access to the proprietary Palo Alto source code is necessary. Without access to this proprietary data, no other vendor could provide the required maintenance. Failure to procure the brand name Palo Alto Wildfire & Threat Protection License Module software license subscriptions and maintenance would put VA’s Cybersecurity defenses at risk. Specifically, failure to procure these subscriptions and maintenance support would negatively impact VA’s response capabilities to attacks which would have disastrous impacts to Veteran initiatives and ability to provide care to Veterans.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among

Palo Alto Wildfire & Threat Protection Control Number VA-21-00070905 authorized resellers for brand name Palo Alto Wildfire & Threat Protection License Module software licenses. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the beta.SAM.gov Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed.

8. Market Research: The Government’s technical experts conducted market research via web based research to review other similar malware protection full packet capture systems. This market research is an ongoing process starting in 2020 and continuously being conducted, as recently as January 2021. The other similar software reviewed included International Business Machines (IBM), Proventia Network Intrusion Prevention System (IPS), Hewlett Packard (HP) Tipping Point IPS, and Cisco FirePower Networks IPS. Based on reviews of these products, the Government’s technical experts determined that none of these products can meet the Government’s interoperability and compatibility requirements previously discussed. Additionally, none of these other products can offer the upstream forwarding of localized data into the existing IO Palo Alto console architecture, which is critical in producing a single view collective status of all source flow security related activity over the network. Review of these products is based on actual VA experience using the competing monitoring software. Additionally, VA networking Subject Matter Experts regularly review industry trade publications and conduct internet research to ascertain if any other brand name software is available.

Based on all of these market research efforts, the Government’s technical experts have determined that only Palo Alto brand name security appliance and licensing can meet all of IO’s needs.

In addition, the contract specialist (CS) conducted market research in June 2021 by using the NASA SEWP V GWAC Provider Lookup Tool to determine what vendors are capable of providing the full requirement. Based on this market research, the CS identified multiple resellers within NASA SEWP able to provide the required brand name products.

9. Other Facts: None.