JA.pdf

Control Number: VA-20-00071167

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center

23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: This proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name International Business Machines (IBM) QRadar Security Information and Event Management (SIEM) Software as a Service (SaaS).

3. Description of Supplies or Services: VA, Office of Information and Technology (OI&T), Information and Technology Operations and Services Infrastructure Operations (IO) has a requirement for brand name IBM QRadar Security Information and Event Management as Software as a Service (SaaS) as part of an additional compute power needs for User Behavior Analytics. Specifically, VA requires one (1) IBM QRadar on Cloud Service Level Agreement, 15 IBM QRadar on Cloud Flows Add-On per 10K Flows per Minute Monthly Subscription, 100 IBM QRadar on Cloud 100 Events Per Second per Monthly Subscription, ten (10) IBM QRadar Cloud Apps Resource Unit per Month, and one (1) IBM QRadar Cloud Apps Service Level Agreement Service Level Agreement, in support of IO SIEM in the cloud. This requirement needs to work with the existing IO Security Threat Module component QRadar architecture that includes QRadar consoles, QRadar licensing and other existing QRadar event collector and processors for central QRadar device management, event reporting, event alerting and event correlation. The required cloud service will support automated analytics of system logs, network flows, and security tool correlation across the enterprise in a centrally managed infrastructure and other existing VA production orchestration activities. The delivery for the IBM SIEM SaaS solution shall be 30 days after receipt of order. The base period of performance shall be 12 months, plus three (3) 12-month option periods, if exercised. The base period shall include an optional task for deployment of the IBM SIEM SaaS solution which may be exercised once the FedRamp ATO is granted.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited: Based on market research, as described in paragraph 8 of this justification, it was determined that limited competition is viable among resellers for the IBM QRadar SIEM SaaS as described

International Business Machines QRadar Security Information and Event Management Software as a Service in section 3 of this justification. The current IO infrastructure is based on existing IBM QRadar hardware and software and VA requires QRadar cloud compute resources to establish an on-premise and cloud hybrid infrastructure, compatible with the existing infrastructure protocols, application programming interfaces, and current functionality to ensure continued operational availability. No other brand name’s SIEM SaaS suite is interoperable with the existing on-premise IBM QRadar interoperability proprietary structures, hardware, or application programming interfaces and only IBM can manufacture cloud configurations that are interoperable with the current on-premise QRadar system based on their proprietary firmware which only IBM has access to. This action is to establish QRadar cloud SaaS portion of the Cyber Security stack which consists of ForeScout, FireEye, Sourcefire, Imperva, and RedSeal. The QRadar infrastructure supports enterprise automated security processes as an out-of-box (COTS) offering which contain correlation rules and threat feed enriching processes.

No other source is capable of providing alternative on-premise appliances, software and SaaS interoperable with VA’s current QRadar implementation to meet VA’s functional requirements. These functional requirements include the continued central management of IBM QRadar network flow, event processing, appnode, licensing management and user behavior analytics from a centralized IBM QRadar console, as well as continued functional requirements on existing production IBM QRadar automated notification and ticketing processes, and automatic updates and configurations of behavior analysis scripts. Additionally, only IBM has the capability to develop and issue software updates and patches for IBM QRadar software necessary to support existing IO requirements to keep the system operational for on-cloud software updating and patching vulnerabilities due to cyber-attacks to prevent data loss.

Replacement of VA’s existing system with a different product, if the IBM QRadar software were abandoned in favor of a different product, would require multiple costs including re-purchase of the software licenses needed for a replacement system, configuration of the new product, testing, user training, and associated maintenance support, which would be duplicative and the associated costs would not be expected to be recaptured through competition. Specifically, implementation of a different solution would require replacing all components of the security stack. Replacement of the aforementioned IO infrastructure would cost an estimated $17 million in equipment and training costs and would require an estimated three (3) years to transition to the new platform. This estimate is based on previous procurement cost of ForeScout, SourceFire, Imperva, and FireEye security appliances. The three year transition is based on VA Information Technology Security Specialists estimate approximately two (2) years of effort to replace/retool the current production IBM QRadar production architecture and retrain VA staff on how to use it. Additionally, this three year transition also accounts for the time that would be required for VA employees to secure training to develop behavior analysis coding to simulate what

QRadar SIEM offers off the shelf. Accordingly, the brand name IBM QRadar SIEM SaaS is the only SIEM SaaS that meet VA’s requirements.

6. Efforts to Obtain Competition: Currently, no other companies other than IBM or a reseller can provide the required on-premise software licenses, on-premise maintenance, technical support and on-premise interoperability with SIEM SaaS.

Market research was conducted, details of which are in Section 8 of this justification.

This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that limited competition is viable among resellers for this brand name acquisition. In accordance with FAR 5.301 and 16.505(b)(2), notice of award of this action will be synopsized on the Federal Business Opportunities Page within 14 days of award and this justification will be made publicly available. This justification shall also be posted with the solicitation on the NASA SEWP V GWAC website for review by prospective offerors.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be fully competed.

8. Market Research: While conducting market research in January 2020 through May 2020 the Government’s technical experts reviewed similar SIEM SaaS, to ascertain if any other items could meet VA’s functional and interoperability requirements. Specifically, the Government’s technical experts reviewed Splunk SaaS, LogRhythm SaaS, and McAfee SaaS, none of which were determined to meet VA’s functional or interoperability requirements. As a result of the market research the technical experts confirmed that only IBM can provide the SaaS which have the necessary functionality described in Section 5, be interoperable with VA’s current infrastructure, and maintain the hardware or software, as the source code required to issue updates is proprietary to IBM. No other company has the capability to develop and issue software updates and patches for IBM QRadar software necessary to support existing IO requirements to keep the system operational for on-cloud software updating and patching vulnerabilities due to cyber-attacks to prevent data loss. Additionally, the existing QRadar’s current application programming interfaces, access to the underlying QRadar source code, knowledge of the proprietary structures and protocols, and interoperability with existing installed software and hardware means no products, other than the aforementioned brand name IBM QRadar SIEM SaaS is able to meet VA’s requirements.

Additional market research was conducted by the Contract Specialist in June 2020 by utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name IBM QRadar SIEM SaaS is available from NASA SEWP V GWAC holders. VA determined that there are several resellers of the brand name IBM QRadar SIEM SaaS that hold current GWACs such that limited competition is anticipated.

9. Other Facts: None.