C01 JnA Redacted.pdf

DB Protect Software and Maintenance Control Number VA-26-00089068

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order

(DO) issued under National Aeronautics and Space Administration (NASA) Solution for Enterprise-Wide Procurement (SEWP) V Government wide Acquisition Contract (GWAC) contract NNG15SD20B with Cynergy Professional Systems LLC (Cynergy) to provide brand name TrustWave Holdings Inc. (TrustWave) DbProtect term software licenses with maintenance and technical support.

3. Description of Supplies or Services: The VA Office of Information and Technology (OIT) Cyber Security Operations Center (CSOC) has a requirement for renewal of 11,000 brand name TrustWave DbProtect Database Vulnerability Scanning term software licenses with maintenance and technical support. In August the Government released solicitation 36C10B26Q0452 on the NASA SEWP V website;

however, due to new information received at that time, the solicitation was subsequently cancelled, and VA is working a separate competitive solicitation.

Therefore, the CSOC requires continuation of the current solution until the new competitive action can be awarded. The VA currently implements TrustWave DbProtect software as the backbone infrastructure of VA’s database vulnerability scanning platform. The Federal Information Security Management Act (FISMA) of 2002, National Institute of Standards and Technology (NIST) 800-53 (CA-1, CA-2, and RA-5), VA Directive 6500, VA Handbook 6500, VA Handbook 6517, and Office of Information Security (OIS) Assessment and Authorization Standard Operating Procedures mandate that the VA audit database security across the VA Enterprise.

VA currently uses TrustWave DbProtect infrastructure to provide real-time Enterprise database vulnerability scanning across all VA database management systems. The DbProtect infrastructure acts as a console with an enterprise database vulnerability scanning view and provides centralized report management; enterprise scalability for multiple users; a centralized repository; load balancing; credentialed management;

and centralized scan and user role-based access management. The OIT CSOC also requires software maintenance to provide vulnerability updates, monthly updates to TrustWave DbProtect’s Shatter Knowledge database, and technical support during normal business hours to ensure the software continues to function as intended.

Further, the technical support required will provide access to designated TrustWave points of contact who possess expert knowledge of TrustWave technologies, as well as the required access to TrustWave’s proprietary knowledge and development resources to customize software source code and interfaces, train VA full time employee staff, and to create scripts so that the VA’s DbProtect infrastructure can communicate with custom applications in use by the VA, as well as provides general product consultation. VA CSOC requires software maintenance and technical

DB Protect Software and Maintenance CONTROL NUMBER VA-26-00089068 this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: No barriers to future competition are anticipated. A competitive contract is anticipated to be awarded in early fiscal year 2027.

8. Market Research: The Government’s technical experts from the CSOC project team conducted market research in August 2026 on database scanning OEMs that provide similar database vulnerability scanning platforms to identify potential sources capable of meeting the VA’s full requirement. Specifically, the CSOC project team reviewed IBM Guardium, Imperva, and Trellix Database Security, to assess their ability to meet VA’s functional requirements. The Governments market research demonstrates that although these OEM provide similar product offerings, including software licenses with maintenance and technical support, they cannot meet VA’s functional requirement to effectively scan databases on day one for all VA database servers to perform the database scanning. As discussed above, with this new information, the Government is working on a new competitive solicitation. Other OEM solutions other than Trustwave DbProject would compromise the integrity of the VA’s current database vulnerability scanning platform without time to implement their own solution. Due to the proprietary data and code of the VA’s Trustwave DbProtect software licenses and infrastructure, maintenance and support can only be administered by an authorized reseller.

Small Business Administration certification database was accessed in August 2026.

This search concluded that Cynergy is registered, certified and qualifies as a SDVOSB in accordance with the federal small business size standard for the applicable North American Industry Classification System Code 541519. It was also verified that Cynergy is registered in SAM.gov database and is eligible to receive Government contracts. The Contracting Officer reviewed NASA SEWP V Program Performance Ratings and all ratings were Excellent for reports, customer satisfaction, information distribution, contract adherence, and delivery, demonstrating Cynergy is a responsible contractor with respect to performance.

9. Other Facts: Procuring Contracting Officer has determined that this proposed action meets all the requirements of 38 U.S.C. 8127(c) and VAAR 819.7008. This acquisition is below the $5,000,000.00 threshold, Cynergy is a responsible SDVOSB for performance of the services described herein, the proposed contract can be awarded at a fair and reasonable price, and is in the best interest of the Government.