C01 JA Redacted.pdf

CyberArk Privilege Account Security Maintenance VA-25-00069590

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-priced task order issued under the National Aeronautics and Space Administration (NASA), Solutions for Enterprise-Wide Procurement (SEWP) V, Government-Wide Acquisition Contract (GWAC) for renewal of CyberArk Software Ltd. (CyberArk) Core Privileged Access Security maintenance support services.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Infrastructure Operations, Cybersecurity Management requires software maintenance and technical support for 2,000 CyberArk Privileged Access Security perpetual licenses. VA’s Continuous Readiness Information Security Program (CRISP) requires the security of all human and nonhuman privileged accounts.

Cybersecurity Executive Order 14028, Federal Zero Trust Architecture Office of Management and Budget Memorandum 22-09 and VA’s CRISP mandates system security monitoring of all privileged user accounts, routine rotation of privileged accounts and systems credentials. Using automated privileged authentication provides enforcement of access to accounts and/or passwords preventing privileged escalation and the ability for users/attacker to move laterally through VA systems.

VA uses CyberArk software to automatically rotate passwords to meet VA’s policy, National Institute of Standards and Technology (NIST) 800-53, and industries standards. To ensure the operational functionality of VA's applications and their accessibility for Veterans, it is critical VA minimizes its system downtime.

Maintenance support is required to guarantee the software functions as intended.

Support shall include software updates, patches, defect support, 24 hours a day x 7 days a week x 365 days a year telephone and email support. VA requires a dedicated telephone number and point of contact information for initiating service requests. The information will streamline communication and facilitate efficient handling of all service-related inquiries or issues that may arise. The period of performance shall consist of four (4) month base period, with one (1) 12-month option period.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on the market research as described in section 8 of this justification, VA has determined that limited competition is available for this action among authorized resellers CyberArk PAS software maintenance and technical support. VA uses CyberArk PAS to secure credentials and automated password rotation per policies to keep applications operational for Veterans. CyberArk software provides required real-time auditing and monitoring of privileged access and the ability to auto-discover privileged credentials and hard-coded passwords. In the VA’s current architecture, CyberArk provides upstream forwarding of localized elevated privilege account auditing, tracking and password vaulting data into the existing IO Cybersecurity Management’s SIEM architecture. Data upstreaming is critical for creating a unified view of all related information that is localized within a system or across the network. Renewal of maintenance support services is required to reduce Federal Information System Modernization (FISMA) Audit associated with NIST and Office of Inspector General’s Notice of Findings and Recommendations security controls. Non-compliance with these findings and recommendations could expose VA privileged user accounts to increased cybersecurity risks. Maintenance renewal for the CyberArk PAS will allow VA to continue critical operations and remediate exposure risk to administrative user accounts. The CyberArk architecture and software communicate through a source code that is based on CyberArk proprietary data. No other software can provide this communication capability without access to this proprietary source code, which is critical to meeting the VA's need. Only CyberArk or its authorized resellers have the ability and data rights to access the existing CyberArk software source code to develop and push software updates, patches, or provide technical support for CyberArk products.

Due to the proprietary constraints the use of any other software would require a complete replacement of CyberArk’s architecture currently in place. VA would be required to replace 150 servers, transition more than 74,000 privileged accounts and passwords to another solution. Additionally, VA would need to develop and configure interfaces that would enable the existing PAS solution to securely connect endpoints with VA applications to meet multiple NIST 800-53 controls. Based on acquisition history, replacement of the current infrastructure would result in an estimated duplicative cost of over $100 million and would require 36 months to implement.

These costs would not be recovered through competition. Failure to renew CyberArk PAS software licenses maintenance support services would cause catastrophic damages to VA. Without a solution in place, pharmaceutical and VA’s medical facility blood bank applications would lose its ability to communicate with surgical rooms and outside pharmacies. Communication is vital to knowing blood bank levels for patient care. VA would not have the administrator rights or permissions necessary to repair and restore accounts resulting from unauthorized access or performance related issues. The applications would not function as intended and lead to a work stoppage for VA patient care programs.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the Section 8 of this document. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name CyberArk license maintenance support services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government’s subject matter experts (SMEs) conducted market research in January 2025, by reviewing other maintenance and technical support solutions from vendors to include Quest, BeyondTrust, and Centrify Software. Although other vendors possess comparable capabilities, none can meet VA’s requirements, as outlined in Section 5 of this justification. The vendors do not have access to CyberArk PAS proprietary source code for performing software maintenance services. Additionally, VA SMEs regularly review industry trade publications and conduct internet research to ascertain if any other brand name software is available. At present, there is no other brand or solution available in the marketplace that can meet this requirement. Based on these market research efforts, the Government’s SME have determined that only brand name CyberArk software license maintenance and technical support services can meet VA’s needs.

Additional market research was conducted by the Contract Specialist (CS) in April 2025. The CS used the NASA SEWP V GWAC market research tool to determine which contract holders can meet the requirement. The market research indicated that there are resellers capable of providing the required brand name CyberArk PAS software maintenance and technical support. The CS identified the one (1) Historically Underutilized Business Zone, three (3) Woman-Owned Small Business (WOSB) and/or Economically Disadvantaged, four (4) Other than Small Business, four (4) Service-Disabled Veteran-Owned Small Businesses, and six (6) Small Business. Based on the above market research, limited competition is anticipated, and VA determined there are SDVOSBs that can meet all the Government’s requirements.

9. Other Facts: None

10. Technical/Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, is accurate and complete to the best of my belief and knowledge.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on the limited competition. Additionally, NASA SEWP GWAC prices have previously been determined fair and reasonable. Finally, the successful quote will be compared with the Independent Government Cost Estimate.

12. Contracting Officer Certification/Approval: I certify that this justification is accurate and complete to the best of my knowledge and belief.