JA -Google Threat Intel_final_TAC 2_Redacted.pdf

Brand Name Google Threat Intelligence VA-26-00049165

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price (FFP) task order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name Google Threat Intelligence Software subscriptions which includes support.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS), Cyber Security Operations Center (CSOC) has a requirement to procure annual subscription of Brand Name Google Threat Intelligence (GTI) software. The CSOC uses GTI software for threat intelligence gathering and vetting of indicators. CSOC requires an annual subscription for Brand Name GTI to provide threat intelligence gathering and vetting of indicators with the capability of 10,000 application programming interface (API) script lookup per day, 300 intelligence searches and downloads per month, five

(5) 90-day lookback Retro Hunt jobs per Month, 25 Hunting VTDIFF automatic YARA rule jobs, and associated support. The delivery of the software shall be within seven (7) days after receipt and processing of the delivery order. The period of performance for support shall consist of a 12-month base period with three (3) 12-month option periods.

The total estimated price for the proposed action is , inclusive of all option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR Overhaul) 16.507(a), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Overhaul 16.507(a) entitled “an item peculiar to one manufacturer (e.g., a particular brand-name, product, or a feature of a product that is peculiar to one manufacturer.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, it was determined that limited competition is available among resellers for the required brand name GTI Professional software subscriptions and support. The Government requires a single virus service solution that can be utilized across all CSOC teams and incorporated into many of VA’s existing tools. GTI brand name software is the only software that meets the following VA requirements:

• Integrate with VA’s Security Orchestration Automation & Response (SOAR) platform which utilizes the Swimlane application and provides enrichment of data matching triggering events as identified through the SOAR solution benefiting

Cyber Incident Response (CIR) through validation of triggered events reducing False Positive Reporting.

• Provide automatic pivoting between Indicators of Compromise (IOCs) using up-to-the-minute intel sources, as opposed to the current time-consuming pivoting reducing the time to investigate each IOC.

• Automate the following functions based on custom YARA signatures written by Cybersecurity Advanced Analytics Cyber Hunting & Threat Analysis (CHTA) team deployed in VTI: Malware upload detection (identifying additional factors related to known malware samples uploaded by others in the security community, matched via hash value); Discovery of threat types/sources which pose a significant threat to VA resources: Threat matching searches for enrichment of active investigations performed via internal OIS CSOC teams.

• Provide a comprehensive, historical event review which is essential for tracking Advanced Threats and Focused Operations threats allowing for recursive Domain data (identification of registration details over time) and File detection history showing AV solution identification rates over time and malware family and sample hash/string matching.

• Provide a resource for other internal OIS VA CSOC teams such as Cyber Threat Intelligence (CTI) for their threat intelligence gathering and vetting of indicators and can be directly integrated with CTI Threat Intelligence Platform (TIP) that will be used by all OIS VA CSOC teams for threat response and automation.

• Enable CSOC Cyber Incident Response (CIR) to leverage the solution for URL/Domain/IP analysis as part of their spam/phishing email investigations and be available to the Analyst without interruption.

• Enhance the Cyber Hunt Threat Analysis (CHTA) team’s ability to perform deeper and broader analysis of events while also permitting automation of detections made during proactive hunt operations. Hunt automation allows the OIS VA CSOC to perform at the Hunt Maturity Level 4 as opposed to Hunt Maturity Level 3 according to the SANS Hunt Maturity Model. Leveraging advanced lookup capabilities will also be directly correlated to multiple stages of the MITRE ATT&CK Framework for standardized threat hunting and attribution which gives the option to investigate/analyze deeper into the possible compromise from beginning to end. (ex: Initial Access (spearfishing links), Execution (Compiled HTML File, PowerShell, Scheduled Task, etc.), Persistence (browser extensions, library hijacking, etc.)) Being able to map existing VA security controls with enrichment by VTI directly to the MITRE ATT&CK Framework improving VA’s understanding of adversarial tactics and enhancing VA’s research capability into adversarial activity and indicators of attack.

• Provide the ability to send scheduled request data enrichment, confirmation and validation for emerging possible threats and Incident Response operations/activities.

GTI is the only software that provides all these capabilities in one solution. The CSOC project team estimates if Brand Name GTI is not acquired, acquiring, integrating, and implementing other individual software solutions would require an additional six months planning, training of VA resources, integration of API's with existing tools and reconfiguration of implemented playbooks, resulting in an estimated increase of funding in the amount of , in addition to duplicative software licensing costs, which are not expected to be recovered through competition. If GTI is not acquired VA will be unable to meet increased scanning requirement compliance requirements of the Cybersecurity & Infrastructure Security Agency’s Binding Operational Directive 23-01 (Improving Asset Visibility and Vulnerability Detection on Federal Networks).

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name GTI Software. In accordance with FAR 16.507- 7(c)(1)(i), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with Revolutionary FAR Overhaul parts 6.103-1(d) and 6.301, the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition on future acquisitions for this requirement, the Government will continue to perform market research to consider and ascertain if there are changes in the marketplace that would allow other brand products to work with the existing infrastructure, thus enabling future actions to be fully competed.

8. Market Research: The Government’s technical experts conducted market research beginning in February 2025 and as recently as February 2026, by the CSOC project team. The market research included a review of various websites and trade publications and discussions with data managers and researchers in VA to ascertain if there are other similar software products that can meet the Government’s requirements.

Competitors reviewed included the following: Wildfire Malware Analysis; ESET PROTECT Advanced; Intezer Analyze; and Coro Cybersecurity. Based on reviews of these products, the Government’s technical experts determined that none of these products can meet all of the Government’s requirements discussed above. Additionally, none of these other products combine the several required features into one product.

Review of these products was based on actual VA experience using the competing virus software. Additionally, VA researchers regularly review industry trade publications and conduct internet research to ascertain if any other brand name software is available. Based on these market research efforts, the Government’s technical experts have determined that only GTI Professional brand name software can meet all the VA’s requirements.

In addition, a Request for Information (RFI) was posted to all contract holders on NASA SEWP from March 9, 2026 to March 29, 2026, to ascertain resellers ability to meet the VA requirements. Seven (7) vendors submitted responses, including ETSI (Woman- Owned Small Business (WOSB)), FCN Inc. dba F C N (WOSB), New Tech Solutions (Small Minority Owned Business), SIRC (WOSB), Sterling Computers (WOSB), V3Gate

(Service-Disabled Veteran-Owned Small Business (SDVOSB)), and WWT (Large Business). The CSOC SMEs reviewed the RFI responses and determined that all companies met the technical requirements for providing the required brand name GTI subscriptions and support.

Further market research was performed in March 2026 by utilizing the NASA SEWP Provider Lookup tool to determine whether brand name GTI software is available from NASA SEWP V GWAC holders. It was determined that there are 18 SDVOSB authorized resellers of GTI (OEM Alphabet) products and services. Therefore, limited competition is anticipated among NASA SEWP contract holders for the required software subscriptions and support.

9. Other Facts: None.