Citrix FY25-JA- Fully Approved__Redacted.pdf

Citrix Software, Hardware Maintenance and Technical Support Control Number VA-25-00011248

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for brand name Citrix software licenses, associated maintenance, and technical support to include Citrix Technical Account Manager (TAM) services for both software and hardware.

3. Description of the Supplies or Services: Internal VA staff and external partners require a seamless way to access VA applications both remotely and while on the VA network. To accomplish this goal, requirements include, but are not limited to, compatibility and interoperability with VA virtual desktop infrastructure, passthrough and smartcard authentication capabilities, the ability to host virtual desktop and applications infrastructure on VA datacenter and in the cloud, Section 508 compliance, have least privilege access for printing and clipboard access, ability to perform application load balancing for high availability, and integration of business applications such as Federal Drug Administration (FDA) medical applications, benefits applications, and National Cemetery applications that VA utilizes. VA Office of Information and Technology (OIT), Infrastructure Operations (IO) has a requirement for the renewal of brand name Citrix software licenses, maintenance support for existing brand name Citrix software licenses and hardware, Citrix analysis software, and Citrix TAM services for both software and hardware.

Citrix software is currently installed throughout the existing VA virtual server infrastructure and provides virtual application and virtual desktop access to endpoint devices inside and outside VA’s network. VA’s current use of Citrix provides virtual secure accessibility to servers hosting Computerized Patient Records System (CPRS), Veterans Benefit Management System (VBMS), Burial Operations Support System (BOSS) databases, FDA certified medical applications, as well as over 1,300 other VA applications published to users of existing VA Citrix data center locations. This allows VA to centrally deploy and manage software applications while providing secure, on-demand access to critical business resources accessed 24 hours a day, 7 days a week by internal and external employees, contractors, as well as key external partners such as Veteran Service Organizations. Applications are accessed through two factor authentication with a smartcard and a one-time passcode for approved temporary smartcard exemptions. To ensure continuity of operations for these critical systems and databases, VA OIT IO requires the renewal of the existing 15,000 concurrent user Citrix Virtual Apps and Desktops Premium Edition software licenses.

Additionally, VA currently owns 110 Citrix NetScalers that will require continued maintenance. VA also requires separate brand name Citrix software licenses and hardware maintenance for the 110 existing VA Citrix NetScalers that are dedicated to Citrix applications, Virtual Private Network, Office 365, Online Certificate Status Protocol, and web services backend environments used for high availability to provide more than 95% uptime. The hardware maintenance will be a one-time lifetime return merchandise authorization purchase. In addition, VA requires the renewal and maintenance of 160 Citrix analysis and monitoring software licenses to monitor, manage, and troubleshoot end to end from the client to Citrix servers and Citrix NetScalers. The associated maintenance support for both software and hardware includes downloads, minor software upgrades, troubleshooting features and 24 hours per day, 7 days per week, 365 days per year technical support for all required Citrix software licenses and hardware as well as faulty hardware replacement delivered overnight or by priority mail depending on the urgency of the outage.

Finally, VA requires technical support which includes dedicated Citrix TAM services for both software and hardware. This shall include dedicated software and hardware TAM services to assist VA staff in ensuring high availability of the Citrix environment while utilizing the least number of servers. This avoids unnecessary cost in underutilized hardware and software and, ensures business operations are not negatively impacted by any unscheduled downtime. The TAMs have access to key internal Citrix proprietary resources that only Citrix or an authorized reseller of Citrix products and services can provide. In addition, TAMs assign correct priorities to any technical case VA opens to mitigate system issues. In option year 2, if exercised, VA requires optional tasks to refresh the 110 Citrix NetScaler hardware appliances.

In summary, the Citrix software and hardware maintenance and support services will help VA meet the challenges of supporting up to 15,000 concurrent Citrix users by managing and responding to technical support cases and potential outages. Only brand name Citrix items and services meet all of VA’s requirements, specifically compatibility and interoperability with VA’s existing virtual infrastructure, and integration with critical business systems including CPRS, VBMS and BOSS, hosting on premise and in multi-cloud environments, local granular control printing, and gateway/application load balancing capabilities.

The base period of performance shall be March 30, 2025, through March 29, 2026 with 2, 12-month option periods thereafter and optional tasks in the second option period.

The total estimated price of the proposed action is for the 12-month base, 2, 12-month option periods, and 3 optional tasks.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it has been determined that limited competition is available among authorized resellers for the required brand name Citrix software licenses, maintenance, and technical support. Only brand name Citrix hardware, software, and services meet all of VA’s requirements. Specifically, only brand name Citrix is compatible and interoperable with VA’s existing virtual infrastructure and integrates with critical business systems including CPRS, VBMS, and BOSS, and can meet requirements for hosting on premise and in multi-cloud environments, local granular control printing, gateway/application load balancing capabilities, and Section 508 compliance. Until these capabilities are fully addressed with the new cloud native virtual desktop technologies, VA will need to sustain the use of Citrix until new cloud native solutions are fully developed.

The required Citrix software licenses provide the underlying core functionality necessary for application and desktop virtualization currently being utilized in support of VA’s datacenter consolidation efforts. Additionally, VA’s current remote access infrastructure comprised of Citrix software licenses and hardware, is configured to only support Citrix software through Citrix NetScaler appliances deployed in VA’s internet gateways. The current Citrix infrastructure consists of over 2,300 servers spread across the VA enterprise both on-premises and on the VA Enterprise Cloud that can only work with Citrix software inclusive of the solution providing parsing ability for proxy server sessions to assist in troubleshooting, network analysis and end-to-end performance for virtual applications and desktop sessions to include historical data. The Citrix solution provides the capability of enabling traffic visibility, inclusive of management software, which is based on user application flow statistics in measuring and determining latency on the client side, network side, and application side of the connection. Citrix has proprietary constraints within its software. No other brand name software would be able to communicate with these existing servers. If another brand name software was to be utilized, the current infrastructure would have to be completely replaced with a non- Citrix based solution which would require a similar number of servers to be procured or provisioned, along with all the associated software to include remote access software.

The Government estimates that this effort would take over one year to design, implement, and test before it would be available to support production user load.

Additionally, the Government estimates it would then require an additional three years to migrate user loads, which entails identification of a user group to gather requirements, development of a prototype virtual desktop and/or application, and time for users to test, work on any required revisions, and migrate to production. The migration would need to occur on a phased basis due to the complexity and size of the data. This transition process is estimated to cost at least $57 million. These estimates of time and cost are based on VA’s experience with Citrix Cloud Migration, Citrix Net Scaler costs, and informal estimates provided during the Request for Information (RFI) on alternative solutions. Additionally, any potential alternative solution would also need to be deployed in parallel to the existing Citrix solution to ensure there was seamless coverage thus incurring additional duplicative costs.

Citrix is utilized for remote access to over 1,300 applications, which include CPRS, VBMS, and BOSS. Users from non-VA furnished endpoint devices utilize Citrix for remote access to these applications. VA averages 11,000 remote access users that use Citrix concurrently daily from non-VA issued endpoints thus avoiding the need for VA to procure, deploy, and maintain an equivalent number of VA issued endpoint devices and associated software licensure for these users at a sizable capital and operational expense to OIT. VA currently has licensing for 15,000 concurrent users to enable flexibility without incurring additional costs.

VA uses Citrix NetScaler appliances for several security and functional requirements.

No additional Citrix NetScalers are being procured via this action. These appliances need to be maintained, however, and are the basis for VA’s utilization of the Citrix Virtual Apps and Desktop Premium Edition software licenses. Specifically, VA has been utilizing Citrix NetScaler appliances in its trusted internet connection gateway in providing remote accessibility from internet endpoints to 6 internal data center locations across the enterprise since 2009 and 2 VA Enterprise Cloud Service Providers. Load balancing features must be able to provide specific monitoring probes for Citrix XML service and the ability to provide data to a VA application delivery management system for real-time client and network latency metrics, historical reports, end-to-end performance data, and troubleshooting, to ensure that individual server software or hardware failures do not negatively impact user access to Citrix from inside or outside the VA network.

VA’s existing Citrix brand name software licenses and associated hardware require technical support in order to retain the use of the software, for future software version upgrades, and to ensure that software and hardware issues are addressed in a timely manner. Citrix has proprietary rights to the software licenses and associated technical support. Therefore, the required associated technical support must be compatible with the existing software licenses. Only Citrix, or an authorized Citrix reseller, has the rights to perform the associated technical support. Any other source must have access to the proprietary rights to ensure all the associated technical support provided is properly configured to both the software and infrastructure. Without access to the proprietary rights, another source would not be able to push through updates.

Direct access to Citrix technical support services is critical to the success of not only ensuring the expansion of VA’s remote access infrastructure occurs timely without interruption, but also in assisting VA in technical support case management and potential outages.

Failure to renew Citrix software licenses, would result in a duplication of time and cost, causing impact to customers and funding a separate solution for application load balancing as explained above. Failure to renew Citrix software licenses would impact 24/7 application accessibility from outside VA’s firewall to key, critical business applications including CPRS, VBMS, and BOSS utilized by a large number of medical, benefits and burial personnel daily. Some medical applications only have FDA certification for delivery with Citrix and are relying on the Citrix Enterprise licensing. In addition, Citrix virtual desktops are currently a key component of VA’s continuity of operations strategy and are utilized daily for both network and system access needs of staff, and in emergent situations when weather or other disasters impact abilities of VA personnel to report to physical office spaces. Thus, renewal of licenses and technical support of existing Citrix software licenses is vital to ensure the security and availability of VA’s information technology infrastructure for over 11,000 concurrent Citrix users, which currently access Citrix remotely.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet all of VA’s requirements. However, limited competition amongst resellers of brand name Citrix products and services is available for this brand name acquisition. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(a)(4)(iii) and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to perform market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Market Research was performed by VA technical experts from August through November 2024 to include reviewing the capabilities of alternative solutions including Microsoft Azure Virtual Desktop (AVD), Omnissa Horizon, and Leostream. VA has been piloting the potential Microsoft AVD solution for approximately four years. VA technical experts note that Microsoft AVD cannot meet VA’s requirements. Specifically, Microsoft AVD cannot meet requirements relating to granular local printing, granular clipboard access, hosting in multiple locations (Azure), an inclusive load balancing solution, and is not FDA certified or able to interoperate with VA’s medical applications such as Varian and Spacelabs.

After review, VA technical experts note that Omnissa Horizon cannot meet VA’s requirements. Specifically, Omnissa Horizon cannot meet the requirement for pass through authentication, smartcard authentication, Section 508 compliance, and does not possess an inclusive load balancing solution. The Leostream response to the VA RFI was incomplete and did not address Section 508 compliance or any load balancing capabilities.

The VA Office of Strategic Sourcing also conducted additional market research to ascertain the extent of availability and competition among resellers of the required Citrix software, hardware, associated maintenance, and technical support using a RFI posted to the NASA SEWP V GWAC for renewal of the Brand Name Citrix Requirement. Five responses were received as follows: three responses recommended Citrix brand products and services, from Four Points Technology, LLC, a Service-Disabled Veteran- Owned Small Business (SDVOSB), New Tech Solutions, and BahFed, both small businesses; V3 Gate, an SDVOSB, recommended a Leostream brand solution; and Thundercat, a SDVOSB, recommended Omnissa Horizon brand solution. Neither

Leostream nor Omnissa Horizon brand responses addressed 508 compliance or load balancing capabilities. VA’s technical experts reviewed all responses and determined that only Citrix Brand name solution is capable of meeting all of VA’s requirements.

Additionally, only the Citrix Brand name solution can avoid the unacceptable delays and substantial duplication of cost as explained in Section 5 of this Justification. VA responded to all RFI respondents deemed not capable on February 18, 2025, to inform them of VA’s assessment. No responses have been received from these vendors.

The NASA SEWP V Provider Look-up tool was also utilized and 18 SDVOSBs were identified as resellers of the required Citrix software, hardware, and associated maintenance and technical support. Therefore, limited competition is anticipated.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among NASA SEWP V GWAC holders.

Additionally, NASA SEWP determines that all catalog prices on its GWACs are fair and reasonable. Additional price analysis may be performed in accordance with FAR 15.404-1(b).

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

13. Office of General Counsel (OGC) Review: I have reviewed this document and find it legally sufficient, based on the representations set forth in the documents and, if any, attachments. The Head of Contracting Activity approval is an independently supported decision not wholly reliant on the legal sufficiency determination.

Approval

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby approve the acquisition of brand name Citrix software licenses, associated maintenance, and technical support to include Citrix TAM services for both software and hardware on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.