JA FireEye Final_Redacted.pdf

CONTROL NUMBER VA-25-00056281

JA Template_FAR 16.5_(07-AUG-2024)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for Brand name firm-fixed price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for the purchase of Brand Name Trellix FireEye Network Security sensors (hardware), software, associated maintenance and technical support.

3. Description of the Supplies or Services: VA, Infrastructure Operations (IO) has a requirement for Brand Name Trellix FireEye Network Security Appliance. The IO Cybersecurity group needs to sustain IO’s network environment in accordance with the National Institute of Standards and Technology, Federal Information Cybersecurity Management Act of 2002, and Federal Risk and Authorization Management Program controls. Required appliance maintenance will allow for remedying appliance defects as well as enhancing and optimizing the appliance. Maintenance is required to provide 24x7x365 assistance via telephone, e-mail or website. The required hardware shall be delivered within 30 days after receipt of order. The period of performance for maintenance and technical support shall be 12 months from receipt of the order followed by two 12-month option periods. The required network security sensors will support increased traffic at the VA Information Technology Centers located at Austin and Philadelphia, ensuring the necessary functionality, enabling real-time threat response, and reducing throughput bottlenecks and detection latency. VA also requires maintenance support and technical expertise for subscription licensing to address software and hardware upgrades and/or defects, as well as recommendations for enhancing and optimizing the sensor equipment specific to the VA enterprise environment.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research described in Section 8 of this justification, it has been determined that limited competition is available among resellers for brand name Trellix FireEye network security sensors, software, associated maintenance and technical support services. Brand name Trellix FireEye sensors must be integrated into the existing network security stack, as there is no interoperability between vendors for the required functionality. These sensors are essential for enhancing throughput and processing capabilities – without them, VA’s current protections will be ineffective. This security stack component enhances VA’s ability to detect suspicious network activity and prevent attacks that evade traditional signature and policy-based security. By integrating multiple artificial intelligence, machine learning, and correlation engines, it rapidly identifies and responds to advanced threats and lateral movements within minutes. No other hardware or software security sensor can provide this functionality because no other brands’ similar products can integrate with the existing brand name Trellix FireEye architecture, infrastructure, and licensing. Without this seamless integration into the unified product console, monitoring, and visibility of vulnerability activity on the network would be impossible. While other devices such as International Business Machines (IBM) Security Network Intrusion Prevention System, Cisco IronPort, and PaloAlto WildFire provide malware protection and monitoring to some degree, no other products are interoperable with IO’s existing Trellix FireEye architecture. Additionally, data monitoring and malware activity captured by another vendor cannot integrate with the existing IO infrastructure components. Acquiring different network monitoring devices and support would require a separate infrastructure to accommodate a new security appliance, resulting in redundant costs already invested in the existing system. This would not only impact malware protection, but also hinder advanced threat detection, anomaly identification, and overall network visibility – expenses that would not be offset through competition. Failure to procure the required brand name Trellix FireEye solution would severely impact IO’s ability to defend against hundreds of weekly cybersecurity threats, malicious network activities, and potential breaches, jeopardizing the integrity of our protected healthcare and Veteran data ecosystem. Due to these proprietary constraints, use of any alternative brands’ sensors and ancillary services would necessitate the complete replacement of the existing Trellix FireEye network security infrastructure for all VA information technology centers as well as regional data centers. Such a replacement effort is estimated to cost approximately $4.5 million and would take approximately 24 months to accomplish. These estimates are based on previous VA acquisitions and implementation experience. These duplicative costs are not expected to be offset through competition.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that limited competition is available among resellers for the required brand name Trellix FireEye maintenance on the NASA SEWP V GWAC. In accordance with FAR 16.505(a)(4)(iii)(A)(2), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR

5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized upon award on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there changes in the marketplace that would enable future requirements to be competed.

8. Market Research: The Government’s technical experts conducted market research from December 2024 through February 2025 and confirmed that brand name Trellix FireEye operating systems remain proprietary and that only brand name Trellix FireEye or its authorized resellers can provide the required sensors and ancillary services.

Specifically, the Government’s technical experts reviewed similar security monitoring products for potential integration, concluding that brand name Trellix FireEye is required to meet proprietary needs with VA’s existing security appliances within VA Information Technology Centers and Regional Data Centers.

The Contract Specialist (CS) conducted additional market research March 25, 2025 by using the NASA SEWP V GWAC Provider Lookup Tool to determine what vendors could meet the requirement using keyword: FireEye, which returned parent company Symphony Technology Group (STG) and multiple service-disabled Veteran owned small businesses (SDVOSB) were identified as resellers of the required brand name Trellix FireEye sensors, software, associated maintenance and technical support.

Therefore, limited competition is anticipated.

Based on the results of the review set forth above, there is reasonable expectation that two or more SDVOSBs will be able to provide the required support. Therefore, the Request for Quotes will be released as a SDVOSB set-aside under NASA SEWP V GWAC, under the Value-Added Reseller NAICS code 541519.

9. Other Facts: None