JA_AACS_Redacted.pdf

OIS Assessment and Authorization and Control Number: VA-24-00080109 Compliance Support Services Extension

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed sole source action is for a modification to the Firm-Fixed-Price (FFP) Task Order (TO) 36C10B19N10070016 issued under Transformation Twenty-One Total Technology Next Generation (T4NG) Contract VA118-16-D-1007 with Booz Allen Hamilton (BAH), 1 Christopher Way, Eatontown, NJ 07724. The purpose of this modification is to extend the period of performance (PoP) of Option Period Four for two months and incorporate two additional two-month Option Periods. This extension will serve as a bridge of support for Office of Information Security (OIS) Assessment and Authorization and Compliance Support (AACS) Services until a new competitive TO is awarded and properly transitioned.

3. Description of the Supplies or Services: The scope of the AACS Services TO is to provide technical support services that include development, maintenance and reporting of applicable information security compliance and associated vulnerability data as well as associated software and hardware asset management data. The support includes ensuring the availability and integrity of this data in support of the VA Cybersecurity Operation Center (CSOC) Cyber Threat Intelligence (CTI) Program, VA OIS

(DHS) Continuous Diagnostics and Mitigation (CDM) Program, and many functions services ensure device, system and accreditation boundary visibility into all assets is available to individual information system owners as well as security personnel and auditors to ensure appropriate technical security is deployed and maintains current, required security compliance. The TO provides the capability to report exceptions to information security requirements and strategies to identify non-compliant assets and systems that could expose VA to unnecessary or unauthorized risk. The support consists of 31 Subject Matter Experts (SMEs) that staff multiple, interrelated compliance programs and provide enterprise-wide endpoint security and compliance monitoring and reporting, authorization, and accreditation support for defined Federal Information Security Modernization Act (FISMA) system boundaries.

Critically, the Enterprise Visibility and Vulnerability Management (EVVM) and Software Assurance (SwA) tasks of the AACS TO serve to further the OIS mission to advance the overall cybersecurity posture through enhanced visibility, with leading edge guidance, support, and tools, while simultaneously ensuring VA and its information systems, practices, policies, processes, and procedures comply with Federal mandates.

The Assessment and Knowledge services are not required for the requested extension as they are being transitioned to another contract. OIS requires that the current EVVM and SwA compliance services provided in the AACS TO outlined above for Option Period Four under TO 36C10B19N10070016 continue without interruption to prevent a negative impact on the availability and cybersecurity integrity of all VA critical systems, Promise to Address Comprehensive Toxics (PACT) Act Systems, and High-Value Assets providing Veteran care and services as well as employee services. The overall PoP shall be extended from June 13, 2024 to August 12, 2024, and incorporate two additional two-month option periods for continued support through December 12, 2024, if needed. The total estimated value of the proposed action, including option periods, is

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(B) supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this action is BAH, 1 Christopher Way, Eatontown, NJ 07724. BAH is the current Contractor on the AACS Services TO. On August 23, 2019, the TO was awarded on a competitive basis under fair opportunity procedures on the T4NG contract vehicle. The PoP consisted of a 10-month Base Period beginning August 26, 2019, with four 12-month Option Periods and one Optional Task. Subsequently, on May 31, 2023, the final option period was exercised and currently expires on June 12, 2024. The requirements development for the competitive follow-on TO, Enterprise Visibility Support Services (EVSS), began in the fourth quarter of Fiscal Year (FY) 2023. As the requirements were being reviewed and defined numerous changes were being implemented causing significant updates to be needed to the requirements. Software Assurance code reviews under the existing AACS TO are being performed using Fortify software and processes related to that product. In FY 2024 a change in strategy was implemented switching the requirement to new processes utilizing CodeQL The new strategy required significant rework to the EVSS requirements. There were also changes in the strategy for the alignment of the Knowledge Service and Risk Management Framework Step 5 Review services provided in the AACS TO. This change in strategy resulted in further changes to the requirements removing some parts that would be aligned with other existing contracts and adding new requirements to finalize the new requirements. All of this rework was ongoing in FY 2024 Q1&Q2 pushing the recompeted competitive action out a couple months.

The solicitation is anticipated to be released in July with award being made in August 2024. This projection is at a minimum two months beyond the current TO expiration date. Once the competitive TO is awarded, there is also a need for up to 90 days of overlap to support a seamless transition of the services to a new vendor, as planned in the original AACS TO. For these reasons, AACS requires support provided by BAH beyond its current end date of June 12, 2024, until the EVSS TO is awarded and transitioned.

Under this TO, BAH is currently providing and meeting the programmatic and technical support requirements as described in Section 3 above for AACS. The multiple AACS environments are complex and unique. EVVM contractor SME team monitors and reports on Endpoint Compliance of over 650,000 VA desktops, laptops and servers. The EVVM SME team on the AACS TO provides EVVM application operations and maintenance support that includes daily operations, troubleshooting, working with BigFix HCL Premium Support Services, and reporting based on IBM Cognos Business Analytics platform (OIS Executive Dashboard), Microsoft Internet Information Server and SharePoint development and maintenance, Custom Script Maintenance and development, Microsoft Structured Query Language (SQL) database administration, software upgrades, help desk support, program management, applications support, development, and trending analytics system support. The SwA contractor team reviews source code of VA developed applications for the identified ~150 VA Critical Systems leveraging tools such as Fortify to reduce software defects that could lead to interrupted services or compromised sensitive information of the services provided to our Veterans and VA employees.

The OIS Hosted Platform and services needed to operate the AACS environment include an infrastructure composed of extremely high performance, fully redundant components including all solid state, state of the art nonvolatile memory express (NVMe) storage, NVMe over Fiber Channel switching and newest generation Intel Xeon processor servers mirrored between two fully redundant VA Trusted Internet Gateway facilities. There are a considerable number of highly complex Extract Transform, and Load services that extract critical endpoint data into a consolidated data warehouse that stores many terabytes of trended information that feeds many hundreds of highly complex, analytically tuned reports leveraging IBM Cognos and tailored views that supports Cognos ad-hoc reporting and dashboarding as well as data-sharing between many other VA systems (e.g., DHS CDM Splunk COTS Software, VA CSOC Splunk, Service Now, VA custom built Information Central Analytics and Metrics Platform (ICAMP) for vulnerability presentation for remediation by Operations staff, the VA Governance Risk and Compliance (GRC) platform Enterprise Mission Assurance Support Service (eMASS) providing the compliance artifact information for Authority to Operate (ATO) for all VA IT Systems and others).

Due to the scale of the BigFix implementation covering over 650,000 VA endpoints complex scripting development and maintenance along with many other products and services are required to support the AACS environments.

The BigFix SME team also operates and sustains the Bigfix Remote Control (BFRC) capability that provides remote system and desktop support services for Windows, Linux, and Mac computers. This capability is used by VA OIT End User Operations to support VA Employee end users working on premises or remotely, on VA provided Government Furnished Equipment (GFE) or their own personal equipment (Bring Your Own Device (BYOD)). The VA Platforms teams uses it to remotely manage servers in various instances. Medical device teams use it to remotely manage medical devices.

VHA and VBA use BFRC to remotely support Veterans to help them navigate VHA and VBA external services websites. NCA uses BFRC to remotely manage their gravesite locator kiosks. Any gap in operation support would rapidly deteriorate this capability and cause loss of all capabilities without any other options in many cases. Tools such as Microsoft Remote desktop to replace BFRC capabilities have limitations, only working on VA systems that are on the physical VA network.

The SwA SME team leverages Fortify and other tools to assess programmatic defects in the thousands of lines of code and seeks out potential issues in VA developed applications requiring superior expertise in secure systems engineering and application development skills. Code and application implementation vulnerabilities can lead to exploitations by bad actors causing service interruptions and even data breaches that can lead to exposure and exfiltration of highly sensitive Veteran and even VA employee information including Personally Identifiable Information and Personal Health Information. A lapse in AACS Services would lead to tremendous reputational and financial damages to Veterans, VA, the taxpayers, and VA employees. Preventing these defects are critical.

Extending the current TO with BAH enables continuity of operations, sustainment, and currently onboarded SME resources to address ongoing operations, outages, or other service needs. Without this continuation of services, VA faces a gap in service which would rapidly cause a work stoppage, causing a halt to the operations of the EVVM, SwA programs, and immediately inhibit the many programs listed above which would negatively impact the ability to provide high-quality data and capability to the VA organizations listed above. Additionally, the BigFix platform is an Enterprise Control Provider key to not only report on security configurations for operational needs, but also for correcting configurations, detecting issues, discovering threat indicators of compromise, determining vulnerable software exposure levering the software inventory capability and providing key artifacts for the annual Office of Inspector General (OIG) IT audits. The AACS support services need to continue to support the securing of VA systems protecting Veteran and Employee information, healthcare and benefit delivery systems and all IT driven VA services provided until the new Contract/TO is awarded.

Any source other than BAH would require significant ramp up time of approximately 90 days, which would cause a work stoppage and prevent VA from being able to provide the level of technical support necessary to continue support of all AACS operations including the continuous operation and availability of the aforementioned infrastructure, application, and software. The following sustainment and operations (e.g., setting up content for distribution to endpoints, creating and maintaining baselines, writing custom fixlets and analysis, utilizing relevance language mastery, Cognos configuration and management, data sharing configuration and maintenance, report configuration, etc.)

are unique to the AACS environment. Further, additional time would be necessary to account for the onboarding process which is estimated to take approximately 30-60 days. Specifically, activities that must occur during the ramp-up time include obtaining National Criminal Fingerprints, Government Furnished Equipment issuance and Personal Identity Verification. Delays and lack of technical knowledge would have very real and dire consequences in providing technical support services to include development, maintenance and reporting of applicable information security compliance and associated vulnerability data as well as associated software and hardware asset management data. This would have an impact on the data sharing with the programs mentioned above. These programs require device, system and accreditation boundary visibility into all assets to ensure appropriate technical security is deployed and maintains current, required security compliance. This work includes the capability to report exceptions to information security requirements and strategies to identify non-compliant assets and systems and lack of these efforts would expose VA to unnecessary or unauthorized risk. In addition, the lack of specific support skills would jeopardize the mission of OIS to advance the overall cybersecurity posture through enhanced visibility, with leading edge guidance, support, and tools, while simultaneously ensuring VA and its mission pa policies, processes, and procedures comply with Federal mandates.

The requirements specific to the AACS environment are unique, deeply technical that require a historical knowledge of the patches, workarounds, and custom hardware developments needed to achieve a working environment. As such, it is in the best interest of the Agency to extend the current TO with BAH to ensure continuity of services until the competitively awarded TO is transitioned.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this document. This effort did not yield any additional sources that can meet irements. There is no competition anticipated for this acquisition.

In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Contract Opportunities website, SAM.gov and the justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: No barriers to future competition are anticipated. A competitive TO is anticipated to be awarded in August 2024 and future acquisitions will be awarded on a competitive basis.

8. Market Research: In March 2024, the Government technical experts reviewed several General Services Administration Highly Adaptive Cybersecurity Services (as the potential competitive TO contract vehicle) vendors (Deloitte & Touche LLP, Accenture Federal Services, LLC., General Dynamics, Raytheon Company, Tista Science and Technology Corporation) that could possibly supply capable SME resources and found that none of them would be able to start on day one providing the AACS services. The vendors would be unable to provide the seamless support needed for AACS. This is due to the limited number of SMEs with large enterprise (>250,000 endpoints), multi Bigfix server implementations and, at present, only BAH is capable of providing seamless AACS (EVVM and SwA) services until award of the competitive TO. This extension will provide for the timely continuance of this critically needed support in order to ensure there is no gap in service. This market research supports a VA determination that only BAH is capable of providing continued AACS services until award of the competitive TO. This extension will provide for the timely continuance of this critically needed support in order to ensure there is no gap in service.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this task order action will be fair and reasonable based on a comparison with the Independent Government Cost Estimate and price analysis.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of a FFP modification to be issued under T4NG Contract VA118-16-D-1007 TO 36C10B19N10070016 for AACS Services, on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.