FY24-JA-GenISIS-Firewall 002 MP 090924 Redacted.pdf

VA-24-00098817 GenISIS Firewall

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC), for brand name Fortinet FortiGate virtual firewall appliances, as well as the associated brand name maintenance and technical support for the Office of Research and Development.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA) Office of Information & Technology (OI&T) has a requirement for the procurement of brand name Fortinet FortiGate virtual firewall appliances for Veterans Health Administration (VHA) network domains in VA Enterprise Cloud (VAEC) sites hosted by Amazon Web Services (AWS) GovCloud and Microsoft Azure GovCloud. The purpose of this procurement is to provide secure encrypted data links for the Genomic Information System for Integrative Sciences (GenISIS) High-Performance Analytical Cluster, the research informatics platform supporting the Million Veterans Program (MVP) and the Cooperative studies Program (CSP) of the VA Office of Research and Development (ORD). Additionally, VA requires associated brand name Fortinet FortiGgate maintenance and technical support. Software maintenance includes all new fixes, patches, corrections, releases, updates, versions and upgrades to the software.

Technical support consists of a range of services providing 24x7x365 assistance for software via telephone, e-mail, or website. The maintenance and technical support shall include a four-year manufacturer warranty with 1-hour response for critical issues.. The total estimated value of the proposed action is

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, it was determined that limited competition is available among resellers of the Fortinet FortiGate virtual firewall appliances and associated maintenance and support. Only brand name Fortinet FortiGate virtual firewall appliances have the capability to satisfy the Government’s requirements.

GenISIS Firewall

Fortinet security technologies are currently in use securing the GenISIS platform in two physical data centers. The technology stack (hardware plus software) provides secure access to the GenISIS environments and secure communications between the GenISIS environments in multiple data centers. The Government's technical experts conducted market research as outlined in Section 8 below. As a result of the market research, the technical experts confirmed that the Fortinet FortiGate virtual firewall is built using proprietary software and is only available through authorized resellers. Furthermore, only Fortinet authorized resellers are capable of providing the required technology and technical support because of the proprietary technology required to develop and implement these updates and ensure the services provided on the virtual equipment are properly configured. No source other than Fortinet or its authorized resellers are capable of providing the required maintenance to meet VA’s security functional requirements.

The GenISIS environment currently utilizes a Fortinet security system consisting of hardware and software. Purchasing another security product other than Fortinet, would require duplication of license, maintenance, hardware and installation costs. It would cost the VA six to 12 months of effort to test a new security product to ensure it could migrate security rules and procedures to a new system, and bring the new system online. The cost of replacing hardware which is currently in place in addition to the configuration labor associated with the licenses would cost approximately $1,100,000.00. The deployment of a new system would require an additional $30,000.00 in configuration labor. In addition, the VA Research and Development infrastructure would be at significant risk of security breaches during the downtime required to stand up the new system. Research activities would also be impacted depending on whether any work would need to be regenerated as a result of this downtime. The estimated cost of this would be a minimum of $500,000. The estimated total cost of replacing Fortinet would be approximately $1,600,000.00 and would not be recoverable through competition. The implementation of new security technology would substantially inhibit the efforts of the GenISIS operations staff to conduct their primary mission which is to support the research arm of Veterans Health Administration, thus hampering VHA in its core mission of improving Veteran’s health by advancing medical practice through biomedical research. No other products researched were compatible with or interoperable with the existing Fortinet software code, proprietary hardware structures, protocols, and software application programming interfaces as currently implemented and operational in the GenISIS datacenter infrastructure. Based on the above, only brand name Fortinet FortiGate virtual firewall appliances and their associated software support and maintenance, can meet all of the Government's requirements.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Fortinet products, as well as associated software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for the requirement described herein, the Government’s technical experts will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research:

The Government's technical experts conducted market research January 2024 through August 2024 by reviewing similar technology to ascertain if these products could meet VA's requirements. Specifically, the Government's technical experts reviewed similar companies/organizations that provide security technology, such as Juniper, Palo Alto, and Cisco. As a result of the market research, the technical experts confirmed that as the source code required to issue the updates is proprietary; Fortinet or its resellers are the only sources capable of providing the required software maintenance and technical support. No other source has the capability of developing and issuing software updates and fixes for Fortinet software necessary to support existing GenISIS requirements. All other products researched were unable to meet VA's security requirements.

Additionally, none of these other products can meet VA's interoperability and compatibility requirements with the existing Fortinet implementation in the current GenISIS datacenter infrastructure.

Additional market research was conducted by the Contract Specialist (CS) in August 2024 by utilizing the NASA SEWP V GWAC Provider Look-up Tool to determine whether there are authorized resellers of Fortinet products, maintenance, and technical support that hold NASA SEWP V GWACs. The CS searched for Fortinet, who is the Original Equipment Manufacturer (OEM), and found that the search revealed thirty-one Service-Disabled Veteran Owned Small Businesses (SDVOSB) of which nineteen are considered to be Approved Resellers. Furthermore, the NASA SEWP V GWAC has a dynamic catalog where line items can be added based on customer requests provided that the required item or service is within the scope of the NASA SEWP V GWAC contract suite and therefore additional competition may be achieved.

Based on the results of the review set forth above, there is reasonable expectation that at least two or more SDVOSBs will be able to provide the required brand name Fortinet FortiGate virtual firewall appliances and associated support and maintenance. Therefore, given that there is a reasonable expectation of competition between at least two capable SDVOSBs, it has been determined by the Contracting Officer that the subject Request for Quote will be released as a SDVOSB set-aside under the existing NASA SEWP V GWAC contract vehicle, under the Value-Added Reseller NAICS code 541519.

9. Other Facts: Not Applicable

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Determination of Best Value: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among NASA SEWP V GWAC holders. As there are multiple resellers on the NASA SEWP V GWAC capable of providing the brand name Fortinet FortiGate appliances and support, price competition is anticipated. Finally, if necessary, the successful quote will be compared with the Independent Government Cost Estimate.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed $750,000.00, this document serves as the Contracting Officer’s basis for using an exception to fair opportunity process in accordance with FAR 16.505(b)(2)(ii)(B).