JA - FireEye_Redacted.pdf

FireEye Hardware Maintenance Control Number: VA-24-00046367

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Acquisition Operations Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: This proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name FireEye, Inc. (FireEye) hardware maintenance coverage for The Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Infrastructure Operations (IO) Data Centers.

3. Description of Supplies or Services: The VA, OI&T, IO Data Centers have a requirement for brand name FireEye security product hardware maintenance.

FireEye products protect networks against known and unknown advanced malware attacks. FireEye is a behavioral-based malware protection system that can detect and block malware from penetrating the network. The required FireEye brand hardware maintenance will consist of immediate problem escalation to level three FireEye Advanced Support Engineering experts, unlimited number of designated VA callers and secure support website/portal access, and repair or replacement of equipment components that restore systems to full operation and accessibility to the original redundant component configuration. The required hardware maintenance also includes services 24 hours a day, 7 days a week, 365 days per year; initial response to all requests for maintenance within one hour of the initial notification from VA; firmware upgrades, updates to include major releases, point releases, service releases and security releases of applicable firmware on a quarterly basis, and/or within 48 hours in cases where a high risk vulnerability fix becomes available.

The required hardware maintenance is necessary for IO to be able to prevent malware attacks against the VA network by ensuring the existing VA owned FireEye hardware remains operational. The period of performance shall include a 12-month base period with two 12-month option periods. The total estimated value of this action is inclusive of option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited: Based on market research, as described in Section 8 of this justification, it was determined that limited competition is available among resellers of FireEye products and services for the aforementioned maintenance support. Only FireEye brand network security monitoring hardware maintenance will fulfill the Government’s requirements for FireEye maintenance services due to the proprietary nature of the hardware. A non- FireEye service provider would not be able to provide the appropriate hardware maintenance activities because only FireEye service providers will be able to access the proprietary data and information to acquire and implement specific revision upgrades and replacement equipment. Due to these proprietary constraints, the use of any alternative brand hardware maintenance would necessitate a complete replacement of the existing FireEye infrastructure. The Government does not have a requirement to replace the existing FireEye infrastructure. Such a replacement effort is estimated to cost approximately $4.3M and would take approximately 18 months to accomplish. VA’s current investment is approximately $4.3 million for the existing FireEye infrastructure, training, and travel time, and VA estimates it would cost at least that amount to replace the existing FireEye infrastructure. The estimate does not account for the two-year time investment that would be needed for VA engineering design, testing, procedure development, and implementation of a new product. These estimates are based on previous acquisitions and on previous implementation experience and the duplicative costs would not be expected to be recovered through competition. No other hardware maintenance is compatible with or interoperable with our existing VA owned FireEye hardware. Failure to procure the required brand name FireEye hardware maintenance support would compromise VA’s ability to protect against malicious network and system cybersecurity activities.

Without continuation of the required maintenance support, the protection that FireEye provides against VA system and VA data compromise (in support of continued VA systems providing Veteran benefit and services), would be hampered leading to potential harm and cessation of Veteran services.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s technical requirements. However, the undersigned VA technical representative determined that that limited competition is viable among resellers for the brand name requirements specified herein. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be fully competed.

8. Market Research: In July 2024 the Government’s technical experts reviewed similar hardware products to ascertain if these items could meet VA’s requirements. These brands include Broadcom ,Cisco, and Trend Micro. Products reviewed include cyber threat protection, intrusion detection and malware protection. These products were researched via the internet. As a result of the market research the technical experts confirmed that as the source code required to issue the updates are proprietary to FireEye and only FireEye or its authorized resellers can provide the required level of support for the existing FireEye brand equipment. Only FireEye and its resellers can access the proprietary data and information necessary to provide the required maintenance support for the existing hardware. No other hardware maintenance is compatible with or interoperable with the existing FireEye hardware.

The Contracting Officers Representative conducted market research in May 2024 by using the NASA SEWP V GWAC market research tool to determine what vendors can meet the requirement. The market research resulted in the identification of several Service-disabled Veteran-owned small business (SDVOSB) resellers capable of providing the required FireEye brand name hardware maintenance.

Based on this market research, VA has determined that a SDVOSB set-aside on the NASA SEWP V GWAC is a viable acquisition strategy.

9. Other Facts: N/A

Approval

In my role as Contracting Activity Competition Advocate, based on the foregoing justification, I hereby approve the acquisition of brand name FireEye, Inc.

hardware maintenance. This action will be issued on an other than fair opportunity basis pursuant to the authority cited in paragraph 4 above, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date