JA EnCase Software Licenses - Redacted.pdf

Control Number VA-24-00011239

JUSTIFICATIONFOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for award of a Firm-Fixed Price Delivery Order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for the renewal of brand name EnCase Endpoint Investigator annual licenses, maintenance and technical support developed by OpenText, Corp. The solution required is hereafter referred to as brand name EnCase.

3. Description of the Supplies or Services: VA Office of Information Security (OIS) Cybersecurity Operations Center (CSOC) has a requirement for renewal of existing brand name EnCase Endpoint Investigator Licenses, with annual Maintenance and Technical support. EnCase Endpoint Investigator is the VA’s enterprise forensic solution currently deployed to over 700,000 endpoints and the VA enterprise cloud (VAEC). This software allows VA to investigate, contain, and resolve threats to VA’s Information Technology (IT) network by enabling the VA to respond to security incidents, proactively investigate issues of fraud, conduct forensics investigations, and perform network and software audits. EnCase Endpoint Investigator also provides enterprise visibility in support of the Visibility to Enterprise (V2E) initiative. It is also utilized by the VA Office of Inspector General (OIG) to support its investigations. EnCase licensing is subscription based and must be renewed annually to utilize the software. This proposed effort also provides maintenance and support consisting of software upgrades, patches, fixes, updates as well as technical support Monday through Friday 9:00 AM to 5:00 PM Eastern Standard Time.

The period of performance shall consist of a 12-month base period, with two 12-month option periods from date of award. The total estimated value of the proposed action is

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it has been determined that only renewal of the brand name EnCase licenses, maintenance and support meets all the VA requirements.

Brand name EnCase Endpoint Investigator Renewal Control Number VA-24-00011239 of Licenses, Annual Maintenance and Technical Support

Specifically, the current VA CSOC forensic endpoint investigator infrastructure was first implemented in August 2010, and is based on the brand EnCase software, which is proprietary to the OEM. EnCase software is deployed and configured to VA endpoints and meets all of VA’s security requirements. To continue utilizing existing forensic capabilities, VA requires continued licensing, support, and maintenance to ensure that the deployed software functions properly, is usable and ensures software upgrades are received so the software is capable of resolving potential security vulnerabilities. No other software is configured and deployed with the 700,000 VA endpoints being monitored, and no other software could immediately be deployed to this infrastructure without significant reconfiguration, integration, and ultimately disruption.

Further, no other maintenance service or technical support providers have the required access to EnCase proprietary source code, and therefore could not provide software upgrades, patches, or bug fixes to ensure the software is up to date and functioning. Access to this code is critical to ensure that all upgrades, patches, or bug fixes seamlessly interoperate with the existing proprietary software.

Maintenance provided by another source could introduce unacceptable security risks to VA. For instance, maintenance provided by another source risks loss of its cyber forensics’ capability in over 700,000 endpoints thereby impacting VA incident response and visibility. This would result in security vulnerabilities and potential loss of data or exposure of Personally Identifiable Information (PII) and Protected Health Information (PHI). Furthermore, it impacts the OIG as they also rely on EnCase for their investigations, allowing for simplicity of use and common data.

Use of another manufacturer’s licensing support and maintenance would require replacement with a new alternative forensic infrastructure solution including new security software to be purchased enterprise wide and configured to the VA system.

Given the above proprietary restraints and customization of systems to ensure that the brand name Encase solution would function, this would cause a duplication in costs and effort as any alternative software licenses would have to be integrated, configured, and implemented in the VA infrastructure. VA estimates that this would cost at least $1,300,000, and that at a minimum, this would be required approximately 9 months to complete baseline activities such as testing (functional and security) to obtain an Authority to Operate, configuration, customization and deployment activities. For instance, any new solution also requires the replacement of the backend hardware currently supporting CSOC forensic systems, followed by the procurement and installation of new hardware to accommodate the new solution.

Further, during this time VA would have to maintain the existing solution to meet ongoing, critical mission requirements. Of note with respect to the required effort, extensive coordination would be required between Enterprise Engineering, CSOC SDI, OIG, as well as various program offices across the VA to roll back the current solution and the testing and deployment of a new one across 700,000 endpoints.

This additional cost and effort required to recompete would not be able to be recouped through competition. This estimate is based on historical data.

Any break in service risks exposing Veteran data to security breach. This would have a damaging effect on investigating existing VA EnCase forensic infrastructure and would critically impact the VA’s ability to protect veterans’ PHI and PII. Losing its remote forensics capability would result in disruptions in its internal operating system forensic software compatibility and interoperability which would make VA networks prone to malicious attacks, risk the integrity of VA processes like claims processing, and risk Veteran and personal information being exposed. This is an unacceptable risk to CSOC in achieving its mission critical information protection objectives because VA’s IT network supports business-critical applications concerning patient information. Given the above, VA must procure the required brand name Encase maintenance and license renewal as proposed.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name EnCase licenses, as well as software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The VA’s technical experts conducted market research in March 2024 by using web-based research of multiple like-solutions including AccessData Exterro Forensic Toolkit (FTK) and F-Response. to ascertain if any other brand name software is available to meet this requirement. Based on this review, it was determined neither of these competing products could meet the interoperability requirements, nor would have access to the required proprietary source code as described in Section 5.

Additional market research was conducted by utilizing the Market Research Tool on the NASA SEWP V website. This search identified 114 Contract Holders of OpenText Corp.

with 35 identified as SDVOSBs. Also, a Request for Information (RFI) #292173 was posted to all 129 Contract Holders on NASA SEWP V GWAC, specifically Groups B, C, and D on November 14, 2023, to ascertain potential EnCase resellers. Upon the closing of the RFI, there were a total of four responses received stating those vendors could provide a quote should a Request for Quote (RFQ) be posted in the future.

Of the four Vendors, two are certified as Service-Disabled Veteran Owned Small Businesses (SDVOSBs), one as a Veteran Owned Small Business and one Women- Owned Small Business; all were considered responsive and capable. The Contract Specialist utilized the Veteran Small Business Certification (https://veterans.certify.sba.gov/) to determine if the two responsive and capable SDVOSBs were certified in the system and verified they both were.

Based on the market research as described above, there is reasonable expectation that two or more SDVOSBs will be able to provide the required brand name EnCase software maintenance and technical support. Therefore, it has been determined by the Contracting Officer the subject RFQ will be released as a total SDVOSB set-aside under the existing NASA SEWP V contract vehicle, under the Value-Added Reseller NAICS Code 541519.

9. Other Facts: None

10. Technical/Requirements Certification I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Price Determination I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipation of competition and discounts among NASA SEWP V GWAC resellers of the required brand name EnCase Enpoint Investigator software licenses, maintenance and technical support services.

Additionally, catalog pricing for NASA SEWP V GWAC holders has already been determined by NASA to b17e fair and reasonable. Finally, price analysis shall be conducted by comparing the successful quote with the Independent Government Cost Estimate.

12. Contracting Officer Certification/Approval I certify that this justification is accurate and complete to the best of my knowledge and belief.

Advocate for Competition Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of the renewal of brand name EnCase Endpoint Investigator annual licenses, maintenance and technical support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.