CASB JA - Final Redacted.pdf

Netskope Licenses Renewal and Maintenance Support

Control Number VA-24-00087348

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name Netskope Cloud Access and Security Broker (CASB) software licenses, maintenance support, and professional services.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA) Infrastructure Operations (IO) Cybersecurity Management (ICSM) requires brand name Netskope CASB Application Programming Interface (API) Bundle subscription licenses renewal and maintenance support for 7,000 Netskope CASB licenses. The licenses and maintenance support will consist of software upgrades for major releases, high-risk vulnerability fix actions, specialized zero-trust edge integrations, as well as assistance in monitoring security events, system logs, and connectivity to VA services. In addition, this effort provides security controls in the VA Enterprise Cloud (VAEC) environments to ensure security and privacy compliance of all cloud services by VA systems/applications hosted in the VAEC. This action will include maintenance support for up to eight

(8) hours of technical support every week; 24x7 phone and online support; and 24x7 access to Netskope online knowledge base, user manuals, frequently asked questions, and release notes. The VA requires the ability to leverage an application that has the ability to augment cloud application security, increase visibility and conduct risk-based policy enforcement across our hybrid VA environment, only brand name Netskope licenses can meet these requirements The period of performance for this effort is a base period from September 26, 2024, to September 25, 2025, with no options. The total estimated value of the proposed action is

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this justification, it was determined that limited competition is available among authorized resellers for brand name Netskope

Control Number VA-24-00087348

CASB software licenses, maintenance support, and professional services. VA currently uses Netskope to ensure security compliance through the establishment of security controls that identify and mitigate security risks/threats and protect again data loss between VA systems and applications and VAEC cloud service providers.

Additionally, only brand name Netskope is interoperable and compatible with other VAEC systems and applications. The Netskope CASB solution is the only solution that can satisfy VA’s requirement to leverage an application that has the ability to augment cloud application security, increase visibility and conduct risk-based policy enforcement across the hybrid VA environment. Additionally, only Netskope can currently meet the interoperability and compatibility requirements of VA’s hybrid environment.

To date, VA has used the Netskope brand name solution to detect over 3,200 data policy incidents and isolated, on average, 26 malware instances a week. This has enabled VA to ensure security compliance, address security risks and threats, and prevent data loss through established APIs. If a new CASB solution were to replace Netskope, VA estimates approximately a interruption in the availability of the current CASB capabilities that are used to implement security controls. These delays would severely impact the delivery of CASB capabilities such as an absence of advanced data protection for threat and separately for malware protection controls.

In order to implement a new CASB solution that is interoperable and compatible with other systems and applications hosted in the VAEC, VA would need to use the new solution to setup (or build) and configure APIs to interface with VAEC cloud service providers such as Amazon Web Services (AWS) and Azure. Additionally, VA would need to integrate this new solution with mission critical VA systems and applications such as ServiceNow, SalesForce, Microsoft Office 365, and Office of Information Security (OIS) systems and applications. VA has successfully set up, configured, deployed and integrated Netskope into its VAEC operational procedures, and integrated Netskope with other VA systems and applications. In order to ensure interoperability and compatibility of a new solution, VA would need to build new APIs, establish security policies, and conduct extensive testing and implementation within each VAEC environment. Additionally, VA would then need to procure Software as a Service (SaaS) user licenses for the new solution’s API connections and establish protocols and templates for OIS reports.

In summary, based on historical data and previous acquisition and deployment history, the selection of a new CASB solution would ultimately result in an interruption in service delivery estimated at with an estimated cost of which would not be recouped through competition.

If VA cannot continue to obtain the Netskope CASB capabilities, VA is at risk of not ensuring security compliance of its VAEC environments, and at risk of incurring data loss in its monitoring of network traffic. The Netskope brand name CASB solution is currently used by VA to protect and secure Veteran data. An interruption in the delivery of CASB capabilities would ultimately impact the ability to secure Veteran data, satisfy security standards and guidelines (e.g., Trusted Internet Connection 3.0), mitigate security risks, and address security audit concerns. For these reasons, only Netskope brand name licenses meet VA’s requirement.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. The undersigned VA

Control Number VA-24-00087348 technical representative determined that limited competition is available among authorized resellers for brand name Netskope licenses, as well as software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government's technical experts conducted market research from April to August 2024 to evaluate the availability of software licenses, maintenance support, and professional services from sources other than Netskope or its authorized resellers. This research involved reviewing similar software products, including Microsoft Defender and Defender for Cloud Applications. Based on this market research Government’s technical experts have concluded that none of these products can meet the Government’s interoperability and compatibility requirements previously discussed in Section 5 of this justification. Based on this market research, the Government’s IT Security technical experts have concluded that only brand name Netskope CASB Solution will meet the needs of IO Security Monitoring of Hybrid Cloud Applications in use across the Enterprise.

Additionally, the VA technical experts analyzed Gartner’s 2024 CASB Magic Quadrant for Security Service Edge products, which reinforced their conclusion that only Netskope meets the VA’s specific requirements. Should the VA consider any alternatives to Netskope or its resellers, it would need to obtain a new ATO. This process would require setting up, configuring, deploying, and validating the alternative solutions within the VAEC environments. Furthermore, the VA would need to create new APIs and integrate these solutions with other systems and applications hosted in the VAEC, estimating that this transition could take more than months.

In August 2024, the Government's technical experts also utilized the NASA SEWP V GWAC Provider Look-up Tool to confirm the availability of brand-name Netskope products from authorized resellers. The results indicated that there are currently 32 resellers of Netskope, with 18 listed as authorized resellers. Notably, four of the 16 authorized resellers are Service-Disabled Veteran-Owned Small Businesses (SDVOSBs).

Therefore, there are at least two verified SDVOSB authorized resellers that can fulfill the Government's needs.

Control Number VA-24-00087348

Furthermore, the NASA SEWP V GWAC has a dynamic catalog where new items can be added based on customer requests. As long as the required items or services fall within the scope of the NASA SEWP V GWAC, they can be added to the catalog on a daily basis.

Based on the findings detailed above, it is reasonable to expect that limited competition exists within the NASA SEWP V GWAC. As a result of this comprehensive market research, the VA intends to issue a Request for Quotation on the NASA SEWP V GWAC.

9. Other Facts: None

Control Number VA-24-00087348

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based upon anticipated competition among NASA SEWP V GWAC holders who are resellers of the required brand name Netskope CASB software licenses, maintenance support, and professional services. Additionally, NASA SEWP GWAC prices have previously been determined fair and reasonable. Finally, price analysis may be performed in accordance with FAR 15.404-1(b)(2).

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Control Number VA-24-00087348

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Netskope CASB software licenses, maintenance support, and professional services on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.