JA - Digicert_Final_Signed_Redacted.pdf

CONTROL NUMBER VA-26-00000153

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm fixed-price delivery order under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise- Wide Procurement (SEWP) V Government-wide Acquisition Contract (GWAC) for renewal of brand name DigiCert CertCentral Enterprise Secure Socket Layer (SSL) software licenses and maintenance, which includes premium software maintenance support.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information Technology (OIT), Infrastructure Operations (IO), requires renewal of brand name software license and maintenance support for the following DigiCert, CertCentral Enterprise, Secure Site OV with Premium Support. The software certificates are crucial for encrypting and authenticating web and other servers on the Internet.

These certificates are used to secure VA’s websites, which are accessed by the public, veterans, vendors, and others. The software allows VA to manage Transport Layer Security (TLS) and Secure Socket Layer (SSL) certificates across the enterprise. This is required to operate and maintain the VA Enterprise Cloud (VAEC) and all outside VA websites and ensure continued compliance with security policies and TLS/SSL requirements. The Premium Support will consist of certificate upgrades and updates to include major releases, patch releases, service releases, and security releases of applicable software on a quarterly basis and/or within 48 hours in cases with high-risk vulnerability fixes. The contractor shall provide one telephone number and/or a point of contact for VA to contact and open maintenance service calls.

The period of performance consists of a 12-month base period, with two 12-month option periods with an optional task. The optional task consists of up to 50 additional 12-month certificates which may be exercised at any time within the base or option year periods of performance once or multiple times not exceeding a total of 50. As the result of the optional task, the total potential period of performance could reach 48 months if exercised at the end of the last option period. The optional task will allow for the purchase of additional certificates as needed to support a fluctuating user base over time for the Agency. The estimated price of the proposed action for the base period is

, and the total estimated price including options is .

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this document, it was determined that limited competition is available for the required DigiCert SSL certificates including Premium Support.

Managing TLS/SSL certificates across the enterprise has become complex. The DigiCert CertCentral Enterprise SSL solution provides a MPKI console, a simple yet powerful platform to discover and manage TLS/SSL certificates. The cloud-based platform enables IT administrators to automate critical tasks, reducing costs and risks in managing SSL certificates. There is no viable alternative to this product. The transition to a new product may have an impact on VAEC authentication of cloud services. The current network environment is based on existing DigiCert SSL certificates used to support OIT. VA requires support compatible with its existing infrastructure protocols and functionality for continued operational availability. Only DigiCert or an authorized reseller can provide the necessary certificate updates, because of the proprietary source code required to develop and implement certificate/software upgrades and updates. No other source can provide the required certificate/software maintenance that meets VA's unique functional requirements. No other license is compatible with or interoperable with the existing DigiCert SSL proprietary database structures, protocols, and certificate software application programming interfaces.

Replacing the existing certificate software by purchasing new certificate software and corresponding maintenance would require onsite installation and configuration of the new certificate software and re-training of all VA information technology support staff. A technical analysis was performed to estimate the costs and schedule delay of alternative solutions. Based on historical data, if VA were to change to another vendor solution, it is reasonably anticipated to cause a service disruption and delay of approximately 13-months and produce additional migration costs of . Many existing applications utilize middleware that integrates with DigiCert to automate the renewal and provisioning of commercial certificates. Most notable is the use of MuleSoft by Salesforce. There are other such external SaaS applications supported by the Digital Transformation Center that have this type of integration. VA’s centralized platform for PKI certificate management, Venafi Trust Protection Platform (TPP), is integrated with DigiCert’s CA allowing VA to connect directly to DigiCert’s servers to download a complete list of PKI certificates issued to VA. In addition, PKI Operations has consolidated all VA DigiCert accounts under one parent account in the DigiCert portal to have complete visibility of all requests for commercial certificates. The specified brand-name DigiCert is essential to meeting the Government’s requirements, as market research indicates that other companies’ similar products, or products lacking this feature, do not meet and cannot be modified to meet the agency’s needs. Based on the above, brand name DigiCert CertCentral Enterprise SSL certificates including premium maintenance support are the only services that meet the Government's requirements.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name DigiCert CertCentral Enterprise Secure Socket Layer (SSL), as well as software licenses, maintenance, and support. In accordance with FAR

16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Market research was conducted in June 2025 by VA’s technical experts. VA’s technical experts reviewed similar service providers to determine if the current DigiCert SSL being utilized by VA could be supported by other service providers. Specifically, technical experts conducted web-based research on Entrust and Rapid SSL products. As a result of the market research, the technical experts confirmed that the source code required to issue the certificate/software updates is proprietary.

Therefore, DigiCert SSL, Incorporated and authorized resellers are the only source capable of providing the required maintenance for DigiCert SSL certificates with Premium Support. No other software provider has the capability of developing and issuing certificate/software updates and fixes for DigiCert SSL software.

Furthermore, on behalf of OIT, the office of Infrastructure Operations issued a Request for Information (RFI #350503) on the NASA SEWP V GWAC website on July 08, 2025.

The RFI closed on July 20, 2025, with a total of four responses received. All four responses received were from Service-Disabled Veteran-Owned Small Businesses (SDVOSBs). Based on the information gathered from the RFI posting, the VA’s technical experts determined that two of the four respondents were capable of meeting the Government’s requirement. The Contract Specialist (CS) conducted additional market research on August 2025 by utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name DigiCert CertCentral Enterprise Secure Socket Layer (SSL) software licenses and maintenance is available from NASA SEWP V GWAC holders. Based on this search, the CS discovered nine SDVOSB Contract Holders that are approved resellers of the brand name DigiCert.

As a result, there is a reasonable expectation that limited competition exists among capable SDVOSB resellers on the NASA SEWP V GWAC for the brand name DigiCert CertCentral Enterprise Secure Socket Layer (SSL) software licenses and maintenance.

Therefore, it has been determined by the Contracting Officer the subject RFQ will be released as a total SDVOSB set-aside under the existing NASA SEWP V contract vehicle, under the Value-Added Reseller NAICS Code 541519.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Signature:

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipation of competition and discounts among NASA SEWP V GWAC resellers of the required brand name DigiCert CertCentral Enterprise Secure Socket Layer (SSL) Software Licenses and Maintenance. Additionally, catalog pricing for NASA SEWP V GWAC holders has already been determined by NASA to be fair and reasonable.

Finally, price analysis shall be conducted by comparing the successful quote with the Independent Government Cost Estimate.

Signature:

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed , this document serves as the contracting officer’s basis for using an exception to the fair opportunity process in accordance with FAR 16.505(b)(2)(ii)(A).

Signature: