FY21 JA IBM zSecure signed Redacted.pdf

FY21 IBM-zSecure Manager Control Number VA-21-00021758

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order, issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for the purchase of brand name International Business Machines (IBM) Zero Downtime Secure (zSecure) Manager software licenses and associated software maintenance.

3. Description of the Supplies or Services: VA, Office of Information and Technology (OI&T), Information Technology Operations and Services, Infrastructure Operations (IO) environment is accredited as Federal Information Security Modernization Act (FISMA) High under the National Institute of Standards and Technology (NIST) 800- 53 rev4 controls. The purchase of zSecure Manager will support network threat automation and existing Artificial Intelligence technologies needed to maintain VA’s overall network cybersecurity incident response posture. The software will augment existing IBM zSecure Audit functionality in support of production requirements for FISMA System Owner High controls outlined in NIST 800-53rev4.

The proposed action is to procure IBM ZSecure Manager mainframe software perpetual licenses for the following Information Technology Center (ITC) locations, including but not limited to Austin, TX, Hines, IL and Philadelphia, PA to ensure consistent IO environments in a centralized standard across ITCs and District data center cybersecurity infrastructure.

The proposed action will also procure the required software maintenance that will consist of software upgrades and updates to include point releases, service releases and security releases of applicable software on a quarterly basis, and/or within 48 hours in cases in which a high-risk vulnerability fix becomes available. These software upgrades and updates are necessary for IO to continue successful operation of the existing IBM-based infrastructure which supports IO systems and applications. The maintenance is required to ensure the software remains operational.

The Contractor shall provide one (1) telephone number and/or a Point of Contact for VA to contact and open a maintenance support call. The required full level of service includes 24 hours per day, 7 days per week telephone and online coverage with a 2-hour response time. All VA support calls shall be initiated by the VA designated point of contact. The vendor shall provide secure connection capabilities for the downloading of software updates and/or the uploading of diagnostic information. The preferred protocol for transfer is Secure File Transfer Protocol.

The perpetual software licenses shall be delivered on or before June 30, 2021 and the associated maintenance will have a period of performance from July 1, 2021 through June 30, 2022 with a 3-month option period and a 12-month option period.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on extensive market research, as described in paragraph 8 of this document, it was determined that limited competition is viable among resellers for the brand name IBM zSecure Manager software licenses and maintenance support as described in section 3 of this justification. The current IO infrastructure is based on existing IBM mainframe and IBM QRadar hardware and software and VA requires software and support compatible with the existing infrastructure protocols and functionality to ensure continued operational availability. Additionally, VA requires software maintenance inlcuding upgrades and updates to include major releases, point releases, service releases of applicable software on a quarterly basis, or within 48 hours in cases where a high risk vulnerability fix becomes available. Only IBM or a reseller can provide the necessary software updates, because of their access to IBM’s propriety source code required to develop and implement software updates. The vendor’s proprietary coding that allows the existing production system to communicate requires that any additional software licenses can only be provided by IBM or its resellers. In order to ensure that the new software licenses will interoperate with the existing IBM mainframe infrastructure, existing IBM mainframe production processes and the needed functionality growth of zSecure Manager, as well as to ensure the software is maintained appropriately, only IBM zSecure has been determined to meet the Government’s requirements.

In addition, a prior implementation of IBM zSecure Manager and IBM QRadar software licenses already exists in IO across the VA enterprise. Acquisition of a different product, even if another one existed with qualifications that met VA’s stated functional and interoperability needs, would require multiple support costs of approximatley if the IBM zSecure and IBM QRadar software licenses were abandoned in favor of a different product and IO would need to re-purchase the initial software licenses previously purchased at a large additional cost. No other license is compatible with or interoperable with the existing IBM zSecure and IBM QRadar proprietary database structures, protocols, and software application programming interfaces. The brand name IBM zSecure Manager software maintenance is the only software maintenance that meets the Government’s FISMA, System Owner, and franchise requirements.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name zSecure licenses, as well as software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

Furthermore, in accordance with FAR 5.301 and16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: IBM zSecure and IBM QRadar are a commercially available off-the-shelf software license package currently in use in VA. While conducting market research in January 2020 thru October 2020 the Government’s technical experts reviewed similar software products, and their associated maintenance, to ascertain if these items could meet VA’s requirements. Specifically, the Government’s technical experts reviewed Splunk, LogRythm, and McAfee. As a result of the market research the technical experts confirmed that as the source code required to issue the updates is proprietary, IBM is the only source capable of providing the required licensing and maintenance support for zSecure Manager software. No other firm has the capability of developing and issuing software updates and fixes for IBM zSecure Manager software necessary to support existing IO requirements. All of the products researched were unable to meet the interoperability, compability, or functional requirements detailed in paragraph 5 including an integration with existing installed software and thus only IBM zSecure Manager software was found capable of meeting these requirements. Based on all of these market research efforts, the Government’s technical experts have determined that only IBM zSecure Manager brand name software and associated maintenance support can meet all of VA’s needs.

Additional market research was conducted by the Contract Specialist in May 2021 via a search on the NASA SEWP V GWAC Provider Lookup Tool which yielded several resellers of IBM Corporation brand name products.

Furthermore, NASA SEWP V GWAC has a dynamic catalog where line items can be added based on customer requests; therefore, as long as the required item or service is within scope of the NASA SEWP V contracts, items and services can be added to the catalog.

In June 2021, the Contract Specialist queried the VA Vendor Information Pages Database using the keyword “IBM ZSecure Manager” and North American Industry Classification System Code 541519 to ascertain if there were any verified Veteran-Owned Small Businesses (VOSB) and Service- Disabled Veteran-Owned Small Businesses (SDVOSB) who may be able to resell the IBM ZSecure Manager Licenses and Maintenance. The search returned seven (7) VOSBs and 51 SDVOSBs.

9. Other Facts: None