J and A_Redacted.pdf

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed-price Delivery Order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for the renewal of brand name Palo Alto Networks (Palo Alto) license subscriptions and maintenance support.

3. Description of Supplies or Services: VA, Office of Information Technology, Office of Information Security Network Security Operations Center (NSOC) requires the renewal of its existing brand name Palo Alto license subscriptions and maintenance support for the Trusted Internet Connection (TIC) Gateway Application Firewall solution that consists of Palo Alto 7080 Appliances. The VA TIC Palo Alto Application Firewall solution provides enhanced layer 7 security for network traffic flowing into and out of VA. The VA enterprise firewall network is managed from a central Palo Alto application and VA operates more than 30 Palo Alto Networks firewalls throughout the VA enterprise. There is a need to renew existing license subscriptions and maintenance support for eight (8) production firewalls and two (2) non-production firewalls to ensure users have secure and safe network access to applications, files, protection against viruses, spam and malware while continuing to seamlessly integrate with other existing components of the TIC infrastructure. Two

(2) Gateway Application Firewalls are in production at four (4) Internet Gateways located in Sterling, Virginia; Dallas, Texas; Chicago, Illinois; and San Jose, California. The two (2) non-production lab firewalls are located at the Capitol Region Readiness Center in Martinsburg, West Virginia. Software renewal subscriptions will include Threat Prevention, Wildfire Protection and URL Filtering allowing additional security features to be enabled on the firewalls and are utilized by the VA to secure the network from malicious actors. The Threat Prevention feature provides anti-virus, anti-spyware, and vulnerability protection in addition to identifying infected hosts in malicious domains. The Wildfire Protection feature builds on Threat Prevention by including malware sandboxing. The URL Filtering feature provides additional web traffic control and user online interaction based on dynamic URL categories.

Maintenance support shall include 24x7 customer support, hardware replacement, and access to software patches and upgrades. The period of performance is 12 months from October 24, 2020 through October 23, 2021 and shall include two (2) 12-month option periods for continued license and maintenance support renewals.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on the market research as described in section eight of this justification, it was determined that competition is available among resellers of the required brand name Palo Alto license subscriptions and maintenance support on the NASA SEWP V GWAC. VA currently utilizes Palo Alto Networks brand hardware and software to meet VA’s requirements for Application Firewall. The VA enterprise is managed from a central Palo Alto application which interfaces with VA’s existing visibility and monitoring tools, security information and event management tools, and advanced security and analytics tools. VA has also built custom security monitoring and alerting tools that are based on the Palo Alto platform. These tools provide VA management with critical information on active and potential threats to VA networks. As described in Section 3, this action is to renew existing license subscriptions and maintenance support for eight (8) production firewalls and two (2) non-production firewalls in order to maintain current functionality. Failure to renew the license subscriptions and maintenance support for these existing firewalls will reduce the functionality of the existing application firewall enterprise system and present significantly increased security risk to VA networks. It is not possible for another brand firewall software to manage these Palo Alto proprietary devices already in use within VA. Specifically, the existing Palo Alto Gateway Application Firewalls are proprietary to Palo Alto and due to the proprietary code of Palo Alto, no other brand of firewall software is compatible and can interoperate within VA’s existing application firewall enterprise system. Further, replacing any of the existing firewalls with any other brand will require a complete replacement and re-engineering of VA’s existing application firewall enterprise system which would also involve redesigning of the VA architecture including protocols and business processes. The costs associated with replacing the existing application firewall enterprise system is estimated to be in excess of $11M which are based on previous acquisition history and would not be recovered through competition. Additionally, there would be a significant increase in risk to VA information systems during any such re-engineering effort. By way of example, the portal used by VA Information Security Officers (ISOs) to retrieve a complete log of a VA user’s web browsing history is built on the Palo Alto platform.

Engineering another system to provide these functions would result in delays in processing of critical information security reports placing the VA enterprise at significant risk of security breaches. It is estimated that a minimum of 2,880 hours (or approximately 18 months) of senior level engineering time would be required to duplicate the functionality described above using a non-Palo Alto Networks solution, during which time significant security functions would be unavailable to information security teams and ISOs within VA. This estimate is based on previous efforts conducted by VA. In addition, due to the integration and compatibility requirement with the enterprise firewall management appliance, the current functionality of the VA enterprise firewall must be maintained in its entirety in order to prevent any increased risk to VA systems. All of the current application firewalling functionalities are critical to maintaining VA’s current architecture and ensuring compliance with the Office of Management and Budget. The current functionalities of the application firewalling are actively in use by VA and can only be continued by renewing the software licenses for these existing Palo Alto Gateway Application Firewalls.

Additionally, only Palo Alto can provide the necessary maintenance support on the existing firewalls because of the propriety nature of the technology required to troubleshoot, diagnose and configure the Palo Alto solution. Because of the proprietary nature of Palo Alto firewalls, other manufacturers will not have access to the source code and databases required to provide the maintenance support.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among resellers of the required Palo Alto software licenses and maintenance support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: VA technical experts conducted market research in May 2020, which consisted of a review of similar products from alternative manufacturers to include Cisco Systems and Check Point Firewall Security. While other hardware and software solutions from alternative manufacturers exist, no other brand firewall software can interoperate and be compatible with the existing VA enterprise firewall network due to the proprietary source code of Palo Alto systems. Based on the market research, only a Palo Alto software was able to meet all of the technical requirements of the Government including the requirement to interoperate within VA’s current infrastructure. Furthermore, the market research confirmed that no other maintenance support providers have access to the proprietary data required to provide the necessary maintenance support.

Additional market research was conducted in September 2020 by utilizing the NASA SEWP Provider Lookup tool to determine if brand name Palo Alto license subscriptions and maintenance support were available from NASA SEWP V GWAC holders. The search resulted in multiple NASA SEWP GWAC holders that are resellers of brand name Palo Alto products including multiple SDVOSB concerns in Group B(2). Therefore, adequate competition among SDVOSBs is anticipated.

9. Other Facts: None