Final JA Immuta_Redacted.pdf

VA-26-00024225

JA

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for renewal of brand name Immuta Inc. (Immuta) Data Governance and Policy Based Access Control (PBAC) software licenses and maintenance/technical support.

3. Description of the Supplies or Services: VA Office of Information and Technology, Product Delivery Service / Data, AI, and Innovation Services (DAIS) Portfolio / Data Analytics Platforms & Services (DAPS) has a requirement to renew its existing footprint of brand name Immuta with quantity one of Immuta Program License Agreement (PLA) which includes Data Governance and PBAC software licenses and maintenance/technical support services with technical support, assistance service and software maintenance. No additional licenses are being procured under this effort. VA utilizes brand name Immuta’s Data Governance and PBAC as its universal cloud data access control platform that gives data engineering and operations teams the power to automate access control across their entire cloud data infrastructure. The aforementioned brand name Immuta software will provide PBAC based data access and governance capabilities within the Summit Data Platform (SDP). VA requires a solution that will meet its requirements for reduction in data policy volumes and complexity, and application of security and other associated policies in a strategic manner in the SDP. Specifically, VA requires a solution that has PBAC capabilities to support categorization and enforcement in order to provide business continuity for workgroup that are building their products in SDP or for workgroups that are transitioning off of the on-prem environment to the cloud. The SDP is managed and operated by DAPS and is an enterprise data analytics platform which allows VA data analytics community to securely access and analyze data to support evidence-based decision making in order to provide better service to Veterans.

With the renewal of the brand name software, VA also requires maintenance and technical support in the form of Implementation Support and Unlimited Data Consumers for its five named data platforms (currently Corporate Data Warehouse (CDW), Customer Experience Data Warehouse (CxI), SDP, Health Data & Analytics Platform (HDAP) and Enterprise Data Warehouse), access for up to 75 Policy Owners (groups responsible for managing policies). Additionally, VA requires the Enterprise Support Package and a, remote dedicated Resident Solution Architect (.5 FTE).

The period of performance for this proposed action will consist of a 12-month base period with two subsequent 12-month option periods, if exercised. The total estimated value of the proposed action is inclusive of options.

4. Statutory Authority: Pursuant to Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) 16.507-7, the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by RFO FAR 16.507-6(b)(2), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on the market research described in Section 8 of this justification, it has been determined that limited competition exists among authorized resellers for this brand name requirement. Further, the proposed renewal of brand name Immuta software and associated maintenance and technical support is the only brand solution capable of meeting the Government’s functional and technical requirements of enterprise data governance and security requirements for the VA’s analytics environment.

Specifically, the required brand name Immuta software is the only software capable of fulfilling a VA functional requirement of ensuring that updates to security and other associated policies are applied in a strategic manner. Specifically, the brand name Immuta uniquely combines PBAC with Object Tagging Attribute-Based Access Control (OT-ABAC) capabilities to fulfil this requirement. The combination with OT- ABAC is a critical element to the VA because it significantly reduces the quantity of policy modifications required to manage and secure large-scale enterprise data products. The integrated use of PBAC and OT‑ABAC eliminates the need for custom access‑control development. Moreover, by enabling scalable, policy‑driven management of thousands of data products, these capabilities streamline ongoing data operations and reduce dependency on manual oversight, avoiding costs for additional full time data‑management contractors. Together, PBAC and OT‑ABAC deliver a measurable reduction in operational complexity, staffing requirements, and long‑term maintenance overhead, while strengthening governance consistency and agility across the organization. The brand name Immuta software allows VA to implement global policies once across multiple platforms through the use of dynamic variables, nested attributes, and reusable global row-level policies. The combination of PBAC and OT-ABAC is required in the VA due to its vast data landscape. As such, the inherent nature of the brand name Immuta software satisfies another VA functional requirement, which is to reduce data policy volume and complexity. This is achieved through the combination of these capabilities, which provides a scalable, flexible, and efficient governance model. Currently, there is no other alternative brand that can provide this critical functionality.

Additionally, brand name Immuta software is the only data governance and provisioning solution capable of supporting the VA functional requirement of PBAC, enabling policies to be categorized by authorized business purpose while also tracking and auditing user consent. This functionality is essential to ensure VA data is accessed and used only for approved purposes, reducing the risk of unauthorized use, compliance violations, and potential impacts to Veteran care. This allows VA to author the potential policy updates into the brand name Immuta software, and then subsequently enforce on data in platforms across VA clouds – increasing governance and interoperability.

Furthermore, no other source, other than Immuta or its authorized resellers, can provide the required maintenance and technical support. Specifically, any responsible source would require access to the proprietary source code that the brand name Immuta software was developed with. VA does not have access nor own the technical data package rights. Access to that proprietary code is paramount, as updates/enhancements must seamlessly integrate with the deployed software. Further, without the access to the code, a source could not ensure that the software remains operational, perform root cause analysis, or perform code rollback, which is another VA Security Requirement.

Failure to renew the effort as proposed will introduce several intolerable risks to VA.

Specifically, the absence of centralized, automated policy enforcement increases the risk of inappropriate access because least‑privilege controls cannot be uniformly applied, and multiple overlapping policies cannot be resolved to ensure the most restrictive rule is followed. Additionally, without the native auditing capabilities, the VA loses it necessary and comprehensive visibility into who accessed what data, when, and for what purpose. This significantly weakens accountability and traceability. Finally, the inability to set global enterprise‑wide controls further exposes the VA to inconsistent governance practices, creating operational inefficiencies and increased compliance risk. Processes such as requesting time‑bound data access would shift from an automated, fully auditable workflow to a manual effort, making them more error‑prone, less transparent, and harder to monitor. Collectively, these gaps elevate operational, security, and compliance risks across the organization to an intolerable level and would have immediate and serious impact to VA and its ability to deliver on mission requirements.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this document. This effort did not yield any additional resources that could meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Immuta software and support. VA will continue to monitor market trends, new/emerging products, and services for availability of other solutions to meet VA needs. In accordance with RFO FAR 16.507-7(c)(ii) this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. In accordance with RFO FAR 16.507-6(f)(1) this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be completed.

8. Market Research: Market research was conducted between March and April 2026 by the Government’s technical experts to ascertain if other products could satisfy VA’s requirements. Specifically, VA technical experts reviewed Okera and Privacera brand products and services. As noted above, neither of these alternative brand name offerings from these providers can seamlessly integrate into the existing VA applications orfail to provide functional capabilities such as reduction in data policy volumes and complexity, and application of security and other associated policies in a strategic manner, or PBAC capabilities, which also allows VA to categorize data policies by purpose or intention for use, followed by enforcing consent and audit based on the defined purpose. Okera and Privacera brand products do not have a purpose-based policy management and consent tracking system, nor implement an OT-ABAC pattern for data security. Further, neither of these alternative brand name providers can provide the maintenance support required as part of this effort given that they do not have access to the proprietary source code.

Additionally, a Request for Information (RFI) was posted on the NASA SEWP V GWAC on April 29, 2026, and closed on May 20, 2026, to identify potential resellers. The RFI closed with two responses. One Service-Disabled Veteran-Owned (SDVOSB), Alvarez LLC, and one HubZone/Veteran-Owned Small Business (VOSB) (BahFed Corp). Both were determined to meet the requirements as described in the associated Product Description.

Further market research was conducted in June 2026 utilizing the Provider Lookup Tool on the NASA SEWP V GWAC website. Specifically, the search revealed 26 contract holders that provide the brand name Immuta Data Governance and ABAC software licenses required. Of those 26, seven (7) Service Disabled Veteran-Owned Small Businesses (SDVOSBs) are authorized resellers of the required brand name Immuta Data Governance and ABAC software licenses and are certified in the SBA Small Business Search. In addition, the NASA SEWP V GWAC is a dynamic IT contract in which products can be added to vendor catalogs based on customer requests on as frequently as a daily basis, if the required IT item is within scope of the NASA SEWP V GWAC. Given that two or more certified SDVOSBs can provide the required service at a potentially reasonable price, this effort will be issued as an SDVOSB set-aside under

NASA SEWP V GWAC.

9. Other Facts: None

Technical/Requirements Certification I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Fair and Reasonable Cost Determination I hereby determine that the anticipated price to the Government for this contract will be fair and reasonable based on anticipated limited competition, as well as by comparison of the proposed price to previous purchases for the same items. Finally, the proposed price may be compared to the Independent Government Cost Estimate.

Contracting Officer Certification/

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Advocate for Competition Approval In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Immuta software on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.