JA - 36C10B20Q0282.pdf

Control Number VA-20-00017196

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for the renewal of brand name HCL Technologies Limited (HCL) BigFix software license subscriptions, software maintenance, and on-site HCL premium Accelerated Value Program (AVP) technical support for VA’s current BigFix network infrastructure.

3. Description of Supplies or Services: VA, Office of Information and Technology, Information Security has a requirement for renewal of 600,000 existing brand name HCL BigFix Lifecycle Client Device software license subscriptions, 600,000 existing HCL BigFix Compliance Client Device software license subscriptions, software maintenance, and on-site HCL premium technical support for VA’s current BigFix network infrastructure. No additional software licenses will be procured as a result of this action. HCL BigFix is a systems management software application suite used throughout all of VA to deploy security patches, software and forensics tools to combat cyber security attacks, and to perform an inclusive inventory and security compliance reporting on all VA Operating System (OS)-based endpoints (e.g.

servers, workstations, laptops) while identifying the security posture of each endpoint. The software allows for VA to rapidly deploy software security updates to remediate vulnerabilities and prevent future unauthorized intrusions into VA networks and provide control over VA information technology equipment inventory.

This allows for computer endpoints to be disconnected in order to prevent cyber security attacks from spreading. In addition, BigFix provides visibility for each computer system connected to a VA network, both local and remote, which gives VA the ability to check all endpoints for viruses and malware and verification that the latest security updates are installed on all endpoints.

The required brand name HCL BigFix software maintenance shall consist of all standard upgrades, patches, fixes, updates, and security resolutions developed by HCL. The premium technical support services (formerly AVP support service) shall provide for two on-site BigFix software suite technical subject matter experts with direct connections to BigFix product development who will be the points of contact for this support, consisting of 24/7/365 technical support access via telephone, email, and on-site visits if required. The premium technical support shall also provide for the analysis, troubleshooting, and resolution of any software product-related problems or questions encountered by Government users with the specified software products. The Contractor shall provide additional content support for the BigFix platform leveraging Microsoft Windows Server 2008 OS Extended Support

HCL BigFix Software Subscription and Support Control Number VA-20-00017196 already purchased from Microsoft under a different contract. Under the Microsoft Extended Support for these OS, Microsoft will provide OS patches (e.g. Security Fixes) that will allow the secure operating of these OS past their end of publicly available support life. This extended capability is key to allowing additional time for VA program offices to upgrade or replace operational systems supporting various services in support of Veterans. These software maintenance and technical support services will ensure the current software is continually updated and remains fully operational. The Period of performance shall be September 16, 2020 through September 15, 2021.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research as described in Section 8 of this justification, it was determined that limited competition is available among resellers of the required brand name HCL Bigfix Software license subscriptions, software maintenance, and on-site HCL premium technical support. The existing HCL BigFix software solution is a highly configurable software suite of products integrated into an environment that supports VA information security capabilities. VA previously acquired these perpetual licenses and deployed the proprietary systems management and business analytics software solutions from IBM in 2010. In June 2019, IBM sold Bigfix and AVP to HCL. VA currently owns the equivalent of approximately 600,000 BigFix Lifecycle Client Device software licenses, 600,000 IBM BigFix Compliance Client Device software licenses when converting existing Resource Value Units (RVUs) used by servers, a server buffer and the remaining server RVUs.

Only software maintenance and premium technical support services provided by HCL, or a reseller, can meet the requirements as the existing software is proprietary to HCL. Specifically, without access to HCL proprietary source code, no other source is able to provide software upgrades, patches, fixes, updates, or security resolutions. Without the required software maintenance and premium technical support, the existing BigFix software performance would eventually degrade and would not be usable by VA as its systems management and business analytics software solutions. In addition, VA would not receive security updates and other critical content, which could compromise entire VA on premises and cloud networks security posture. Additionally, since the software is proprietary, no third-party source exists that provides analysis, troubleshooting, and resolution of any software product-related problems other than a BigFix reseller.

Existing VA systems management software infrastructure consists solely of the BigFix software application suite. The procurement of another vendor’s systems management software application suite would require a completely new infrastructure and impose significant technical risk as VA would have to implement that brand’s entirely new software suite, which could take over a year and cost over $100M to implement a new solution. The risk at this time is amplified by the need to retain the status quo in support of BigFix and BigFix Remote Control supporting the COVID-19 surge in remote user telework.

Additionally, no other products evaluated meet the requirements for Federally mandated (FISMA under 44 U.S.C. §3543, https://www.whitehouse.gov/sites/default/files/omb/memoranda/2014/m-14-04.pdf) Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) reporting capabilities (CDM is dependent of BigFix content and BigFix is specifically required under the CDM program), or provide the completeness of OS security patch content, OS deployment capabilities, and compliance checks to support CIS, Defense Information Systems Agency (DISA) Security Technical Implantation Guide (STIG), United States Government Configuration Baseline (USGCB), and Payment Card Industry Data Security Standard v3 compliance reporting. No other products meet the requirements for granular file-level patch detection, corrupt patch detection, and security configuration templates that can be enforced on personal computers (e.g., National Institute of Standards and Technology (NIST), DISA, CIS, and USGCB). In addition, any alternative systems management would also require proprietary software maintenance and technical support which would not resolve the inability to obtain maintenance and technical support from vendors other than through the respective software providers.

Furthermore, no other vendor’s software is compatible with or interoperable with the existing BigFix infrastructure due to proprietary database structures, protocols, and software application programming interfaces. Finally, as detailed in Section 8 of this justification, no other brand software meets all of VA requirement and no other company has access to the BigFix proprietary code.

6. Efforts to Obtain Competition: Currently, no other companies other than HCL or a reseller can provide the required license subscriptions, software maintenance, and premium technical support. Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that limited competition is viable among resellers for this brand name acquisition. In accordance with FAR 5.301 and 16.505(b)(2), notice of award of this action will be synopsized on the Federal Business Opportunities Page within 14 days of award and this justification will be made publicly available. This justification shall also be posted with the solicitation on the NASA SEWP V GWAC website for review by prospective offerors.

7. Actions to Increase Competition: The Government will continue to review and revalidate its requirements as systems management and business analytics software solutions continue to evolve. The requiring activity will continue to research and monitor whether there are emerging products that enter the marketplace that are interoperable and compatible with existing VA BigFix software licenses, and will monitor other new systems management and business analytics software solution product offerings to determine if an entirely new solution could meet VA’s current and future requirements cost effectively through competition.

8. Market Research: In February 2020, market research was conducted by the Government’s technical experts via internet research and review of industry publications to identify if there are other service providers or systems management with products capable of providing similar capabilities as the BigFix software suite.

Market research revealed that BMC Software, Inc. (BMC); Symantec Corporation (Symantec); Tanium, and Microsoft Corporation (Microsoft) offer similar software solutions but cannot meet VA’s requirements. No other products evaluated meet the requirements for Federally mandated (FISMA under 44 U.S.C. §3543, https://www.whitehouse.gov/sites/default/files/omb/memoranda/2014/m-14-04.pdf) Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) reporting capabilities (CDM is dependent of BigFix content and BigFix is specifically required under the CDM program), or provide the completeness of OS security patch content, OS deployment capabilities, and compliance checks to support CIS, Defense Information Systems Agency (DISA) Security Technical Implantation Guide (STIG), United States Government Configuration Baseline (USGCB), and Payment Card Industry Data Security Standard v3 compliance reporting. The competing products listed above also do not meet the requirements for granular file-level patch detection, corrupt patch detection, and security configuration templates that can be enforced on personal computers (e.g., National Institute of Standards and Technology (NIST), DISA, CIS, and USGCB). In addition, an alternative systems management would also require proprietary software maintenance and technical support which would not resolve the inability to obtain maintenance and technical support from vendors other than through the respective software providers.

Additionally, no other vendors can provide the required brand name HCL BigFix software maintenance and premium technical support because these vendors cannot access the developers source code and technical data of the VA current proprietary BigFix systems management and business analytics software applications. Each software developer offers a proprietary system and associated services that will only operate with its respective hardware and software. Based on this market research, only HCL Bigfix license subscriptions, software maintenance, and premium technical support can meet VA technical requirements.

The Government technical experts conducted additional market research in March 2020 to ascertain the ability of any other software to meet VAs needs. Specifically, a Request for Information (RFI) was posted on NASA SEWP GWAC V. The Government received two (2) responses to the RFI, both of which are Service Disabled Veteran Owned Small Business (SDVOSB) resellers of brand name HCL products. Both responses received from the RFI were considered technically acceptable. Based on these market research efforts, the VA determined that several resellers of the brand name HCL BigFix software maintenance and premium technical support hold current GWACs such that limited competition is anticipated.

Additional market research was conducted in April 2020 by utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name HCL products are available from NASA SEWP V GWAC holders. VA determined that there are several resellers of the brand name HCL products that hold current GWACs such that limited competition is anticipated.

9. Other Facts: None.