JA - BigFix.pdf

Control Number VA-21-00004933

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name HCL Technologies Limited (HCL) BigFix Lifecycle, Compliance and Inventory Client Device perpetual software licenses, software maintenance and on-site HCL premium technical support for VA’s current HCL BigFix network infrastructure.

3. Description of Supplies or Services: VA, Office of Information and Technology (OIT), Information Security (OIS) has a requirement for brand name HCL BigFix Lifecycle, Compliance and Inventory Client Device perpetual software licenses, software maintenance, and on-site HCL premium technical support for VA’s current BigFix environment. VA currently owns approximately 579,000 brand name HCL BigFix Lifecycle, Compliance and Inventory Client Device perpetual software licenses which VA anticipates use of for at least the next six years.

HCL BigFix is a systems management software application suite used throughout all of VA to deploy security patches, software, and forensics tools to combat cyber security attacks, and to perform an inclusive inventory and security compliance reporting on all VA Operating System (OS) based endpoints (e.g. servers, workstations, laptops) while identifying the security posture of each endpoint. The software allows VA to rapidly deploy software security updates to remediate vulnerabilities and prevent future unauthorized intrusions into VA networks and provide control over VA information technology equipment inventory. These software security updates allow for computer endpoints to be disconnected to prevent cyber security attacks from spreading. In addition, HCL BigFix provides visibility for each computer system connected to a VA network, both local and remote, which gives VA the ability to check all endpoints for viruses, malware, and verification that the latest security updates are installed on all endpoints.

The required brand name HCL BigFix software maintenance shall consist of all standard upgrades, patches, fixes, updates, and security resolutions developed by HCL. The premium technical support services shall provide for two on-site HCL BigFix software suite technical subject matter experts with direct connections to HCL BigFix product development who will be the points of contact for this support, consisting of 24/7/365 technical support access via telephone, email, and on-site visits if required. The premium technical support shall also provide for the analysis, troubleshooting, and resolution of any software product-related problems or

HCL BigFix Control Number VA-21-00004933

2009 when it was used successfully to bring real-time endpoint visibility during a cyber incident. After that success, VA’s Chief Information Officer directed that BigFix be expanded to all endpoints going forward. Since that deployment the BigFix platform has become a critical component relied upon by multiple VA activities.

The Enterprise Visibility and Vulnerability Management (EVVM) program fulfills Office of Management and Budget (OMB) Memo M-10-15 requiring all Federal agencies to continuously monitor security-related information from across the enterprise and present this information to the various levels of agency-wide management to enable timely, risk-based decision making. As part of EVVM program, BigFix continuously monitors multiple families of National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Information Systems and Organizations. HCL BigFix is the only systems management software application suite that meets all Federal Information Security Modernization Act (FISMA) requirements under 44 U.S.C. §3553 for CyberScope reporting capabilities, completeness of the OS security patch content, OS deployment capabilities, and compliance checks. More specifically, HCL BigFix is the only software application suite capable of securely supporting VA remote systems for both endpoint management capabilities (e.g. patching, configuration changes, software management, etc.) and desktop end-user support and desktop end-user support for users of the system by, among other tasks, supporting application troubleshooting, adding/changing printers, and installing programs. Only the HCL BigFix solution can meet all of the following critical functional requirements:

reporting capabilities; completeness of the OS security patch content; OS deployment capabilities; compliance checks to support Center for Internet Security (CIS), Defense Information Systems Agency Security Technical Implantation Guide, United States Government Configuration Baseline, and Payment Card Industry Data Security Standard v3 compliance reporting; granular file-level patch detection;

corrupt patch detection; and security configuration templates that can be enforced on personal computers (e.g., the National Institute of Standards and Technology, the Defense Information Systems Agency, CIS, and US Government Configuration Baseline). HCL BigFix accomplishes this through use of its proprietary Compliance Security Checklist (e.g. Defense Information System Agency (DISA) Security Technical Implementation Guide (STIG)) content and capability for the continuous monitoring of checklist items. This checklist compliance information is then leveraged in the Information System Assessment and Authorization process to provide IT Systems their Authority to Operate. HCL BigFix is used throughout all of VA by multiple VA organizations for these requirements.

Due to the proprietary nature of the HCL BigFix software solution, no other vendor’s software is compatible with or interoperable with the existing BigFix infrastructure.

No other vendor could have access to the HCL Big Fix proprietary database structures, protocols, and software application programming interfaces. Therefore, the procurement of any other vendor’s systems management software application suite would require a complete replacement of the existing HCL BigFix infrastructure in place.

VA technical experts estimate that even if another software solution existed that could meet VA requirements, the time and costs required to pivot to any alternative solution would take a minimum of four to six years and cost over $100M in duplicative costs which would not be recouped in competition. These estimates are based on previous acquisition history and previous configuration efforts. These estimates reflect the technical complexities of multiple organizations (OIT, Non-OIT and External to VA) that are required to be engaged to allow for the changing and configuring back-end infrastructure and removal of BigFix data feeds from the multiple supported activities from Department of Homeland Security (DHS) CDM to various VA Organizations (e.g. Information Central Analytics and Metrics Platform, ServiceNow Configuration Management Database, Cyber Security Operations Center Splunk, OIS Executive Dashboard, Enterprise Mission Assurance Support Service Security Configuration Compliance Data, Continuous Readiness in Information Security Program, Cyber Threat Intelligence, and Cyber Incident Response, Web Reports for IT Operations, DHS Cybersecurity and Infrastructure Security Agency Emergency Directive Reports, etc.) and the software removal from 600,000+ endpoints, deployment of new software to those same endpoints, as well as training costs for system administrators and multiple levels of support staff across multiple organizations within OIT. These estimates also account for the pulling of terabytes of data through the BigFix Application Programming Interface and incorporating them into multiple external systems, the duplicative costs to procure new licenses for the alternative solution, costs for additional resources necessary to implement the new solution, and required maintenance of the existing BigFix solution that would need to be maintained in parallel until transition is complete.

In addition to the prohibitive length of time and costs involved in pivoting to alternative solutions, there is also technical risk because any new solution may not immediately meet operational requirements as needed, impacting users and service to Veterans. HCL BigFix continues to support emergency events and most particularly the COVID-19 surge in remote user telework. With the continuing shift in employees working remotely and a large increase in the number of total VA endpoints that need to be covered, the technical risks in pivoting to any other solution would be amplified. HCL BigFix is currently the only VA tool capable of securely supporting VA remote systems for both endpoint management capabilities (e.g. patching, configuration changes, software management, etc.) and desktop end-user support for using the system, applications, adding/changing printers, etc. The platform is in use every minute of every day for these functions and any interruption in those services would immediately, negatively impact VA support of Veterans.

VA is mandated by OMB Memorandum M-14-03, “Enhancing the Security of Federal Information and Information Systems” to support the entire VA infrastructure and various cloud hosting facilities (Trusted Internet Gateways, Federal Risk and

Authorization Management Program (FedRAMP) Cloud Instances (e.g. Microsoft Azure, Amazon Web Services, etc.), and contracted service provider sites), which VA implements using HCL Bigfix software. This capability is an essential piece of the Department-wide continuous monitoring capability and the specialized software and support is a necessary component of the EVVM program. Through HCL BigFix, the EVVM program provides nearly real-time security status, support for patch management, and remediation of software configuration issues for Department-wide system components. HCL BigFix is the product that has been fully vetted and implemented in the EVVM architecture since 2009. This purchase renews the support for VA perpetual licenses for the existing infrastructure, allowing for uninterrupted support as has been done since BigFix first entered VA as part of the VA VPN solution for Government Furnished Equipment called RESCUE. If the software is not purchased VA will be unable to fulfill its obligations for DHS CDM, endpoint management, cybersecurity monitoring and many other activities.

The CDM program, established by Congress, is intended to provide adequate, risk-based, and cost-effective cyber security, and more efficiently allocate cybersecurity resources. The use of HCL BigFix allows VA to implement the mandates of OMB Memo M-14-03 as well as implement one of six steps in the NIST Risk Management Framework.

Without procurement of the BigFix Lifecycle Client Device perpetual software licenses, software maintenance and on-site HCL premium technical support, VA will be unable to fulfill its many of its obligations including DHS CDM, endpoint management and cybersecurity monitoring. While the existing VA-owned BigFix perpetual licenses would allow the platform to keep functioning indefinitely, the platform usability and value to the organization would rapidly decrease. Use of the BigFix and Cognos that runs the OIS Executive Dashboard (http://dashboard.tic.va.gov) platforms would have to be reduced, planned expansions would not happen, platform performance may experience lengthy outages, performance would degrade requiring curtailed utilization, any discovered vulnerabilities would go unpatched in the platform, remote systems not on VPN would not be manageable as BigFix and BigFix Remote Control are the only VA tools that work off the production network. Pandemic (e.g. COVID-19), hurricanes, other natural disasters, other mass impact events and even normal operations requiring telework support would be severely impacted. Users with issues would have to bring their systems to VA facilities to be addressed costing millions of dollars in resources, lost productivity, and impact to Veteran care.

HCL BigFix has been vetted and approved through its software supply chain and software development lifecycle via the Committee on Foreign Investment in the United States process. Any replacement software would require a similar supply chain assessment and continuous monitoring program. Additionally, any other vendor would be required to obtain multiple certifications and approvals that would take years to accomplish including Security Content Automation Protocol Validation, Cryptographic Module Validation, and DHS CDM Product Approval in addition to providing DISA STIG and CIS security compliance checklist content.

Only software maintenance and premium technical support services provided by HCL, or a reseller, can meet the requirements as the existing software is proprietary to HCL. Specifically, without access to HCL proprietary source code, no other source can provide software upgrades, patches, fixes, updates, or security resolutions. Without the required software maintenance and premium technical support, the existing HCL BigFix software performance would eventually degrade and would not be usable by VA as its systems management and business analytics software solutions. In addition, VA would not receive security updates and other critical content, which could compromise all of VA computer systems (desktops, laptops and servers) on premises at the various VA facilities, remote and in the FedRAMP cloud service provider networks (e.g. Amazon Web Service, Microsoft Azure, etc.) security posture by removing the ability to continuously monitor these systems for missing security patches and providing the ability to patch them. Since the software is proprietary, no third-party source exists that provides analysis, troubleshooting, and resolution of any software product-related problems other than HCL, the vendor, through a BigFix reseller.

6. Efforts to Obtain Competition: Currently, no companies other than HCL or a reseller can provide the required license subscriptions, software maintenance, and premium technical support. Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that limited competition is viable among resellers for the brand name license subscriptions, software maintenance, and premium technical support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301(a)(2)(ii), 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the SAM.gov website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to review and revalidate its requirements as systems management and business analytics software solutions continue to evolve. The Government will also continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: In February of 2021, market research was conducted by the Government’s technical experts via web-based research and through review of industry publications to identify if there are other service providers or systems management vendors with products capable of providing similar capabilities as the HCL BigFix software suite. Market research revealed that BMC Software, Inc.

(BMC); Symantec Corporation (Symantec); and Microsoft offer similar software solutions, but cannot meet VA’s requirements as BMC and Symantec products currently do not meet the FISMA requirements under 44 U.S.C. Specifically, BMC and Symantec products cannot meet CyberScope reporting capabilities, completeness of the OS security patch content, OS deployment capabilities, and compliance checks to support CIS, Defense Information Systems Agency Security Technical Implantation Guide, United States Government Configuration Baseline, and Payment Card Industry Data Security Standard v3 compliance reporting.

Microsoft’s System Center Configuration Manager currently does not meet the FISMA requirements under 44 U.S.C. §3553. Specifically, Microsoft cannot meet CyberScope reporting capabilities, granular file-level patch detection, corrupt patch detection, and security configuration templates that can be enforced on personal computers (e.g., the National Institute of Standards and Technology, the Defense Information Systems Agency, CIS, and US Government Configuration Baseline).

Additionally, due to proprietary constraints, no other vendor can provide the required brand name HCL BigFix software maintenance and premium technical support because no other vendor has access to the developer’s source code and technical data of the current proprietary HCL BigFix systems management and business analytics software applications. VA does not possess the proprietary technical data and code for HCL BigFix to offer to a non-Original equipment Manufacturer. Without this technical data, no other source can provide the HCL BigFix software maintenance and premium technical support other than HCL or a reseller. This code is required to ensure all services provided are properly configured. HCL BigFix offers a proprietary system and associated services that will only operate with its respective hardware and software. Based on this market research, only brand name HCL Bigfix Lifecycle, Compliance and Inventory Client Device perpetual software licenses, software maintenance, and premium technical support can meet VA technical requirements.

Furthermore, a Request for Information (RFI) was issued on April 15, 2021 via the NASA SEWP V GWAC website to ascertain if there were resellers that could meet the Government’s requirements for brand name HCL BigFix products and associated maintenance and support. The RFI # 190167 closed on April 27, 2021, with three responses received proposing HCL solutions. No alternative solutions were proposed. Two of the three HCL resellers who responded to the RFI are Service-Disabled Veteran-Owned Small Businesses (SDVOSB). Based on the information provided, the Government Program Manager determined three resellers (Software Information Resource Corp (SIRC), METGreen, and Three Wire Systems, LLC) to be technically capable of performing the effort. Two of the resellers found capable of meeting the requirements, METGreen and Three Wire Systems, LLC, are SDVOSB. Additional market research was conducted in April 2021 by utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name HCL products are available from NASA SEWP V GWAC holders. VA determined that there are several resellers of the brand name HCL products that hold current GWACs such that limited competition is anticipated.

9. Other Facts:

VA (IT Operations) makes significant investments in other software products, none of which can meet the requirements of OIS for this procurement, but for which BigFix serves as a secondary support system. IT Operations chooses the best products to meet their operational needs. These investments include Microsoft SCCM (Windows systems management), JAMF/CASPER (Apple Macs systems management), AirWatch (Mobile Devices systems management), RedHat Satellite/Puppet (Linux Devices systems management), Tenable Nessus (Device Visibility and Vulnerability Management), and Forescout (Hardware and Software Asset Management).

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipation of competition and discounts among NASA SEWP V GWAC resellers of the required brand name HCL BigFix license subscriptions, software maintenance, and premium technical support. Additionally, catalog pricing for SEWP V GWAC holders has already been determined by NASA to be fair and reasonable. Finally, price analysis shall be conducted by comparing the successful quotation with the independent government cost estimate.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby approve the acquisition of a firm-fixed price delivery order to be issued under the NASA SEWP V GWAC for brand name HCL Technologies Limited BigFix Lifecycle, Compliance and Inventory Client Device perpetual software licenses, software maintenance, and on-site HCL premium technical support for VA’s current BigFix network infrastructure on another than full and open competition basis pursuant to the statutory authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.