CloudKey JA Redacted - Copy.pdf

Control Number VA-21-00060191

LIMITED-SOURCES JUSTIFICATION

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way

Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price task order to be issued on a sole source basis to IronArch Technology, Limited Liability Company (LLC) under its current contract number GS-35F-032DA on the General Services Administration (GSA) Multiple Award Schedule (MAS) for Cloud Support Services (CSS) and CloudKey Sustainment support.

3. Description of the Supplies or Services: To execute the VA cloud strategy and meet operational goals, the Enterprise Cloud Solutions Office (ECSO) requires CSS and CloudKey sustainment support to assist VA in reviewing, validating, and recommending improvements for planning, assessment, execution support, operations, and for the enhancement of VA cloud computing capabilities.

CloudKey, IronArchs’ customized proprietary tool is a web-based cloud migration data collection and decision support tool that provides VA users with an intuitive interface for data gathering, analysis, and assessment of systems migrating to the VA Enterprise Cloud (VAEC).

Currently, IronArch provides CSS support to VA’s critical cloud mission and supports

ECSO in the execution of the VA’s cloud strategy and meeting operational goals. In addition, the current CSS support includes IronArch’s maintenance and support of the propriety VAEC CloudKey tool. IronArch assists ECSO by providing the overall support and maintenance of this critical tool, which helps VA achieve clear traceability and trackability of all ECSO cloud customers.

In relation to CloudKey, IronArch provides data management and reporting customization support. This tool enables VA to conduct requirement analysis initiatives, by capturing and providing use cases, user stories, requirements, and facilitation of CloudKey updates and sprints. In addition, IronArch provides testing activities by conducting performance and maintenance web application testing, to include functional, system integration, regression, and exploratory testing.

IronArch also provides CSS support to key VA ECSO initiatives using CloudKey data.

IronArch provides ECSO with performance management support through tracking VAEC performance measures and targets to achieve strategic objectives. IronArch assists ECSO in monitoring and tracking VAEC applications and operational performance.

Cloud Support Services and CloudKey Sustainment Support Control Number VA-21- 00060191

IronArch supports ECSO’s Quality Assurance initiatives; by maintaining and updating VAEC Health Assessments. Lastly, supports ECSO in the implementation of the Cloud Governance Planning.

CloudKey enables ECSO to track VA systems migrating to the VAEC using the established VAEC Lifecycle Management Framework (VLMF) process. CloudKey enforces business logic within the VLMF to require exit criteria for systems preparation for migration and improves data integrity for ECSO. CloudKey is currently used as

ECSO’s system of record for tracking each step of ECSO’s customers journey into the VAEC. The period of performance shall be a 12-month base period with two (2) 12-month option periods. The total estimated value of the proposed action is which is inclusive of all options.

4. Authority: This acquisition is conducted under the authority of the Multiple-Award Schedule Program. The specific authority providing for a limited source award is

Federal Acquisition Regulation (FAR) Part 8.405-6(a)(1)(i)(B), “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this action is IronArch Technology, LLC, 1313 Dolley Madison Blvd., Suite 404, McLean, VA 22101. This requirement can only be provided by the Original Software Developer (OSD), IronArch. Based on market research, as detailed in Section 8 of this justification, no other source can provide the required brand name CloudKey credit management development, improvement efforts and associated technical support services.

In February 2019, VA began using the IronArch CloudKey software to develop the required technical environment required for the VAEC. IronArch’s proprietary customizations allow for the integration of specific systems/applications information from both Cloud Service Providers (CSPs), Azure and Amazon Web Services (AWS) that comprise the VAEC. IronArch’ s CloudKey tool was customized for use in data collection and aids the ECSO’s decision support and reporting. CloudKey is a proprietary tool that includes specific capabilities, such as an index.html file for the user interface layout and design, a large number of AWS lambada functions containing complex application code, database schema/data model for its implementation in the AWS Relational Database Service (RDS) including low level application code in database triggers and stored procedures, JavaScript libraries and functions that are used to provide a standard approach to analyzing and assessing VA systems.

CloudKey has proprietary algorithms for the estimation of Cloud Hosting Rough Order of Magnitude (ROMs), migration and operational complexity, migration cost estimate and VAEC criticality, which is very specific to VA.

As it is a proprietary tool, no other vendor can provide the required brand name CloudKey credit management development, improvement efforts and associated technical support services as no alternative vendor would have access to the proprietary source code necessary to support these requirements.

If any other vendor was utilized, it would require a complete replacement of the existing software. Replacing the IronArch CloudKey software functionality using another vendor and coordinating VA data collection and reporting needs along with establishing technical requirements to migrate to another software product would require a complete rewrite of the existing CSP credit reporting interface and would require a new interface to be developed, tested, and deployed. ECSO estimates, based on previous acquisition history, that this would cause a 12-month delay where no new functionality, no new integrations, and no enhancements would be available to VA. Additionally, if an alternate tool was used to replace CloudKey, VA would have to procure a new COTS or custom tool. During the development and implementation of a different tool, ECSO would still need sustainment operations for the existing IronArch CloudKey environment which is estimated to cost VA an estimated additional $1.3M in duplicative, non-recoverable costs, as it would take 12 months for the alternative solution to fully be operational. Additionally, based on the current configuration, IronArch developed this tool for the purposes of aligning CloudKey functionality to the VA’s specific and unique needs. Significant effort would be required to configure another Commercial Off the Shelf (COTS) tool or build a new tool to ECSO specifications. Additionally, once the new tool is in place, follow-on activities would also need to be performed, to include migration of CloudKey data to the new tool, integration of the new tool with external sources to include other VAEC applications such as: Active Directory Federation Services Integration (SSO), Power BI (Data Gateway, Reporting), Microsoft Azure Provisioning Tool, VA Systems Inventory (VASI), Apptio, VersionOne, ScienceLogic, VAEC Health Assessment Tools, and Azure/AWS, rebuilding enterprise reporting in

Power BI with new data source, training entire organization on new tool, and final cutover to new tool, process, and reporting. As there would be costs for both maintenance of the current CloudKey configuration and contract selection for a replacement tool, this would significantly increase the cost of performing ECSO’s CSS activities. VA estimates the total cost of implementing this alternative solution between $3.9M to $5.2M in the base year. This estimate is based on previous acquisition history and implementation efforts of similar size and scope. These estimated costs would not be recovered through competition.

The current CSS contract does not include any transitional support of CloudKey Operation and Maintenance or any training related to CloudKey, backend CloudKey management or IronArch proprietary materials or intellectual property. IronArch’s support for VA’s instance of CloudKey would end with the CSS period of performance.

For any new data field requirements in CloudKey, ECSO will have to leverage alternate data collection methods. This may require ECSO to return to a manual process of spreadsheets, email, and other less standardized, more time-consuming methods to gather and report on data. There is no reach-back support included for CloudKey in the license agreement. The CSS contract does not include any transitional support of CloudKey Operations and Maintenance (O&M) nor any training related to CloudKey technology, backend CloudKey management or any other IronArch proprietary materials or intellectual property. IronArch’s support for the VA instance of CloudKey would end with the CSS period of performance and ECSO would not have sustainment support during the personnel onboarding period.

Without sustainment support, ECSO will be exposed to an increased number of known and unknown risks, to include changes and/or modification requirements spurred by updated VA policies, ECSO change requests, process maturation with the VAEC environment, which a new sustainment team would not be prepared or capable to respond. Additionally, any CloudKey outage that might occur during onboarding would be difficult to recover from, causing significant loss of essential services to ECSO and impact cloud wave schedules for migration of VA applications. An analysis would be required to assess which VA applications are scheduled at the end of the IronArch period of performance to determine full impact. It’s unknown, at this time, if cloud migration schedules would slip or if there would be an impact on closing of any VA datacenters.

ECSO’s system of record CloudKey is instrumental in managing the migration of hundreds of VA applications to the VAEC. It’s customized features and functions for VA enable the operation of the VA Cloud Migration entire migration process, track applications in the cloud, facilitate the decommissioning of legacy applications and have been responsible for VA’s ability to rapidly modernize and deliver new and improved innovative services to VA Staff and Veterans.

The VAEC hosts over 130 application touching all 450K+ VA Staff Members and 20M+ Veterans. Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, was signed by the President on May 1, 2021 directs VA to accelerate cloud adoption/migration. Without CloudKey the success of the VAEC/VA Cloud Strategy and

VA’s ability to comply with EO 14028 would be severely negatively impacted. Based on the above, only procuring the IronArch-customized CloudKey software application, associated technical support and sustainment services from the OSD will satisfy the Government’s requirement.

IronArch currently performs the following CloudKey sustainment tasks on the CSS contract: User support and troubleshooting, Database maintenance, API maintenance.

508 compliance, Operating System and Middleware updates and patching, Authority to

Operate (ATO) Minor System compliance, all required updates to maintain compliance with the VA Technical Reference Model, updates derived from IronArch’s continuous improvement of the proprietary software outside of the CSS contract. Additionally, Operations and Maintenance (O&M) activities are utilized to keep CloudKey up to date as processes and software tools within the organization change. These activities include: Monitoring changes to the VLMF, VA policy, and changes in external VA systems, Completing gap analyses of changes and how they impact CloudKey, Updating CloudKey to accommodate ECSO requested changes, Working with ECSO to gather requirements and create user stories to prioritize for development, Creating/updating documentation, reporting, and briefings including CloudKey brown bags, and keeping CloudKey User Guide and CloudKey Operations Guide.

VA and ECSO enterprise reporting rely on the CloudKey database. IronArch maintains multiple key reports for ECSO internal and external stakeholders including: VA Chief Information Officer VAEC Migration Summary Report, ECSO Migration Scorecard, VAEC Production Report VAEC Wave Plan, ECSO Project Quad Chart, ECSO

Operational Performance Report, and ECSO Quality Check Reports. All the specific VA initiated CloudKey customization efforts discussed above allows CloudKey to perform as a single system of authoritative action for personnel, processes, and technology.

CloudKey allows for roles and permissions to control and focus data capture and information visibility. Data captured in CloudKey assists with team collaboration and pre-decision support to determine a VA application’s readiness for Cloud migration and provides for application migration tracking.

Prior to the implementation and customization of CloudKey, data was maintained by individuals in spreadsheets that was manually (time consuming) updated and that could result in conflicting data. Manually updated PowerPoint slides, updates via email and multiple SharePoint sites resulted in limited ability to report at the Enterprise level and track migration timelines and progress. Customizing CloudKey to VA’s environment has helped ECSO replace disparate, outmoded data collection, tracking, and reporting methods with a single, central solution that is the authoritative source for migration tracking. The CloudKey Enterprise and Reporting ability provides VA and ECSO management an ECSO VAEC Migration Scorecard, 45-day Outlook, VAEC production and Wave Plan. CloudKey Master Data facilitates data calls and is Searchable, Sortable, Filterable and Exportable.

The customized CloudKey based permissions allow key stakeholders to complete processes and track migrations for ECSO Intake, Operations, Leadership and VA

Leadership. CloudKey guides users to provide all the necessary data to properly assess applications project, technical and cybersecurity needs. These are the areas of specific, VA initiated customization of the CloudKey tool for ECSO use and is a critical component of the following essential capabilities: ECSO Project Management; Tracking

VA systems through the established 9-step VLMF process to deploy to the VAEC;

Providing traceability and trackability into ECSO migration efforts (coupled Apptio reporting tool); Providing automated criticality assessments to verify that documented architectures and system security plans (SSP) align with what is implemented in the

VAEC; VAEC Health Assessments which evaluate a set of criteria captured in a CloudKey record and provides a recommended VAEC criticality and are used to compare the assessed criticality to information documented for a system to ensure that the system is architected according to criticality and security requirements; ECSO

Operational Performance Report that displays calculated target migrations per month and compares this to the actual completed migrations, allowing leadership to understand how ECSO migration performance is tracking to goals; ECSO Migration Scorecard Reporting which provides high-level reporting for senior VA leadership and at-a-glance reporting on the number of migrations completed, in progress, or in the queue, and displays progress for each ECSO migration planning wave. The report enables ECSO leadership to quickly answer questions about migration progress and performance toward goals; ECSO Cloud Credit Tracking which provides critical system data points of awarded cloud credits to external financial reporting tools via API. This data allows granular slicing of data based on key information in the ECSO business process, including target cloud environment, VAEC key identifiers, and VA Portfolio and Product Line alignments. The sustainment and cultivation of existing capabilities are only available with IronArch’s support. All back end IronArch application support would end once the CSS period of performance terminates, thus greatly increasing security risks, increased bugs, obsolescence, incompatibilities, deteriorating software, etc.

6. Efforts to Obtain Competition: Market research was conducted in May 2021, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. There is no competition anticipated for this acquisition. In accordance with FAR 5.301 and 8.405-

6(a)(2) the award notice for this action will be synopsized on the System for Award Management (SAM) Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The ECSO team conducted market research for the procurement of a CloudKey equivalent application in May 2021. VA’s market research consisted of internet research looking for products that could perform the same or similar functions as the IronArch CloudKey. Though there are multiple products reviewed with the

‘CloudKey’ name, including products from CloudKey Solutions, Ubiquiti Networks, and SourceForge, and other ‘web-based cloud migration data collection and decision support tools’ including those from ScienceLogic, Cloudscape, and AppDynamics none of these are similar products to the IronArch CloudKey product that VA is currently using, nor could they provide additional functionality of the existing CloudKey product.

No other products meet VA’s specific requirements for this CloudKey effort and would cause significant cost and time for development to replace CloudKey as detailed in Section 5 of this justification. Additionally, no other vendor can provide the required brand name CloudKey credit management development, improvement efforts and associated technical support services as no alternative vendor would have access to the proprietary source code necessary to support these requirements.

9. Other Facts: None

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date: ___________________________

Signature: _______________________

11. Determination of Best Value: I hereby determine that the proposed contract action will represent the best value to the Government consistent with FAR 8.404(d). GSA has already determined that the prices on the FSS contract are fair and reasonable.

Additionally, further discounts from the stated FSS prices will be sought.

Procuring Contracting Officer Signature:________________________

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Procuring Contracting Officer Signature:________________________

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Cloud Support Services and CloudKey Sustainment Support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: ____________ Signature: _________________________________

Advocate for Competition

Technology Acquisition Center Office of Procurement, Acquisition, and Logistics