C01 - JA - Palo Alto Redacted at Synopsis.pdf

JSA Palo Alto Networks Support Maintenance Control Number VA-24-00084329

JUSTIFICATION AND APPROVAL

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a Firm-Fixed-Price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurements (SEWP) V Government Wide Acquisition Contract (GWAC) for renewal of brand name Palo Alto Networks threat prevention subscriptions for Palo Alto Networks Firewalls and devices located at the Oracle Health Enclave, Veterans Integrated Service Network (VISN) sites 16, 9, 8, 7, 6, 5, and the Warehouse required for the migration of VISN sites from the Veterans Health Information Systems and Technology Architecture (VistA) to the new Electronic Health Record (EHR).

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information and Technology and Electronic Health Record Modernization - Integration Office (EHRM-IO) requires the renewal of 542 brand name Palo Alto Networks, Inc. hardware maintenance support and threat prevention subscriptions for Palo Alto Networks Joint Security Architecture (JSA) devices. The hardware maintenance support includes 24x7x365 email and phone support, failed hardware replacement within next business day, 1-hour response time for critical issues, and 4-hour response time for non-critical issues. Critical issues are defined as firewalls being down, degradation of customer production environment, and issues for which no workaround is available. Threat prevention subscriptions include Intrusion Prevention, Malware Detection, Security Socket Layer Decryption, File Blocking, and correlation. Palo Alto Networks premium hardware support and threat prevention subscriptions will be used to support the migration of VISN sites from the Veterans Health Information Systems and Technology Architecture to the new EHR. This action is for services only. No hardware or software will be procured as a result of this action. The period of performance shall be a 12-month base period and 2 12-month option years. The optional quantities in the amount of 1,810 subscriptions associated with each option year may be exercised at any point during the period of performance. The increase in optional quantities reflects maintenance licenses that will expire within the next 12 months that cover an additional 1,810 VA owned devices. Any optional quantities that are exercised will automatically be exercised in the following option year. The total estimated price of this proposed action is inclusive of all options.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by the FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is available among authorized resellers for the required brand name Palo Alto Premium Support and threat prevention subscription services. These services are required to continue hardware maintenance and threat prevention subscription agreements supporting the existing JSA Palo Alto firewalls within VA and the Department of Defense (DoD). Palo Alto Networks' Premium device maintenance support and threat prevention subscription services provide the necessary support services to meet VA's firewall security standards and adhere to the existing agreement with the DoD, in accordance with the DoD/VA Joint Electronic Health Record Architecture Description version 1.0, dated 13 February 13, 2018. No other vendor has access to Palo Alto’s software code due to proprietary rights. Palo Alto Networks firewalls are deployed and implemented at Electronic Health Record Modernization (EHRM) deployment sites and require continuous maintenance support. VA is renewing Palo Alto firewall products to ensure the continued operational integrity of the Palo Alto hardware and subscription products supporting the joint installations of VA EHRM and the DoD Medical Enclave Community of Interest Network (MedCOI) firewall equipment, management system. The brand name Palo Alto firewalls and security equipment are located at the Oracle Health Enclave, VISN sites 16, 9, 8, 7, 6, 5, and the Warehouse required for the migration of VISN sites from VistA to the new EHR. Additionally, Palo Alto firewalls and security equipment are at VA Medical Centers (VAMCs), the primary and backup Oracle HealthCerner data centers, and all DoD EHR sites. All firewalls are jointly managed by VA and DoD network operations and information security personnel using an existing Palo Alto Panorama management system. This requirement is in accordance with DoD/VA Joint Electronic Health Record Architecture Description version 1.0, dated February 13, 2018. If the Palo Alto Premium hardware support and threat prevention subscription for deployed Palo Alto firewalls at VISN sites is not renewed, non-support of Palo Alto hardware will result in Firewall failures disrupting the VISN network and secure transmission of protected healthcare data between the DOD MedCOI network, VA VISN sites, and the EHR. This would result in the denial of VISN site access to the DoD MedCOI network and the EHR at the Oracle Health Enclave. Without secure access to the EHR, clinician access to Veterans’ medical records would be compromised, potentially causing imminent patient harm.

If Palo Alto maintenance and subscription support is not renewed, VA would have to replace its existing Palo Alto infrastructure at the Oracle Health Enclave, VISN sites 16, 9, 8, 7, 6, 5, and the Warehouse required for the migration of VISN sites from VistA to the new EHR. It is estimated that this replacement process would take approximately 2 years and cost over . The JSA Palo Alto firewall protects the shared VA/DoD federal enclave of medical data. VA’s replacement of the firewall would require considerable effort by DoD to maintain interoperability. DoD's network upgrades needed for compatibility with the new firewall hardware are not factored into this estimate. These estimates of time and cost are based on an analysis of past purchases. It is not expected that VA would be able to recoup these redundant expenditures. Continuation of an effective firewall is critical to maintaining secure data exchange across DoD, VA medical centers, and the Oracle Health data centers. If the system is shut down due to a cyber-attack, VA personnel and systems at those locations would not be able to access the new EHR or the joint VA/DoD lifetime medical record. Immediate access to protected medical data is essential to ensuring quality patient care to the Veteran community.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, it was determined that limited competition is viable among authorized resellers for these brand name services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: In May 2024, VA technical specialists from the Government did market research by comparing identical service offerings from different brands to see if they could fulfill the VA's functionality requirements. According to online research conducted by government technical experts, while other manufacturers offer similar service offerings (Fortinet, Cisco, Packard, and Aruba Network), only Palo Alto Network's Premium Device Support and threat prevention subscription for VA's owned Palo Alto devices can meet VA's networking requirements, including compatibility and interoperability with the existing MEDCOI environment shared by other government agencies.

As stated in Section 5, currently Palo Alto firewalls and security equipment are at all VAMCs, the primary and backup Oracle Health data centers, and all DoD EHR sites.

All firewalls are jointly managed by VA and DoD network operations and information security personnel using an existing Palo Alto Panorama management system, in accordance with DoD/VA Joint Electronic Health Record Architecture Description version 1.0, dated February 13, 2018. Therefore, only Palo Alto Networks' Premium device support and threat prevention subscription services can provide the necessary support services to meet VA's firewall security standards and adhere to the existing agreement with DoD, in accordance with the DoD/VA Joint Electronic Health Record Architecture Description version 1.0, dated February 13, 2018. No other vendor has access to Palo Alto’s software code due to proprietary rights.

In addition, the Government used the NASA SEWP V GWAC Provider Lookup Tool in June 2024 to identify over 20 Palo Alto Networks resellers, 14 of which are Service-Disabled Veteran-Owned Small Businesses, who appear capable of achieving the criteria to meet the government’s need.

9. Other Facts: None.