JA Imperva Hardware and Software Maintenance - Redacted.pdf

Control Number VA-23-00022438

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-wide Acquisition Contract (GWAC) for the renewal of Imperva hardware and software maintenance and Designated Support Engineer (DSE) support.

3. Description of the Supplies or Services: VA, Office of Information and Technology, Cyber Security Management , Infrastructure Operations (IO), has a requirement to renew brand name Imperva hardware maintenance, software maintenance, and DSE support for existing Imperva products currently in use at Austin Information Technology Center. The brand name Imperva hardware maintenance shall consist of firmware upgrades and updates to include major releases, point releases, service releases and security releases of applicable firmware on a quarterly basis, and/or within 48 hours in cases where a high- risk vulnerability fix becomes available for six (6) X6510 Web Application Firewall Appliances, fourteen (14) 10 Gigabit Ether Network Interface Cards, and enhanced support for six (6) X6510 Web Application Firewall Appliances. This support shall include technical support via telephone, e-mail, or internet to troubleshoot defective hardware that restores full operation and accessibility to the original redundant configuration. Additionally, software maintenance will also provide technical support via telephone, e-mail, or internet to troubleshoot malfunctioning software that restores full operation and accessibility to the original configuration. Finally, the DSE shall act as a single point of contact for all support issues. The DSE will provide expedited case handling and escalation as needed. The DSE will also provide proactive support, maintenance, tuning and optimization of SecureSphere, an Imperva product VA utilizes for database security. The DSE will host weekly status calls for a maximum of three customer accounts with services and support capped at 15 hours per week. The Contractor shall provide one telephone number for VA to contact and open a maintenance support call. The Contractor shall provide support services 24 x 7 x 4 x 365 (Hours per Day x Days per Week x Hours per initial call x Days per Year). All VA support calls shall be initiated by the VA designated point of contact. When applicable, the Contractor shall provide secure connection capabilities for the downloading of software updates and/or the uploading of diagnostic information. The preferred protocol for transfer is Secure File Transfer Protocol. This action is for services only. No hardware and software will be renewed or procured through this action. The period of performance shall be 12-months from September 1, 2023 through August 31, 2024.

Imperva Hardware and Software Maintenance and Support VA-23-00022438

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B) entitled, “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is viable available among resellers for brand name Imperva hardware and software maintenance and DSE support. The current IO infrastructure is based on existing Imperva hardware and software and VA requires support compatible with the existing infrastructure, protocols, and functionality for continued operational availability. The support will provide all current and future patches, upgrades, security vulnerability remediation, diagnosis and troubleshooting support, and configuration guidance to systems of Imperva. Only Imperva or an authorized reseller can provide the necessary hardware and software support on the software that is inherent to hardware within the existing VA-owned Imperva environment because of the proprietary source code required to develop and implement software upgrades, firmware and updates. Due to these proprietary constraints, use of any other brand name hardware maintenance, software maintenance and support would necessitate a complete redesign, reengineering, and redevelopment of the existing infrastructure. Specifically, based on previous acquisition history, VA technical experts estimate that to replace the existing Imperva hardware and software would produce duplicative costs of approximately $2.1 million. Additionally, VA technical experts have stated that during any replacement of hardware and software, VA would also have to continue maintaining the Imperva hardware and software in addition to the new hardware and software which would result in further duplication of costs running two different brand names over the estimated three year period for full implementation. This estimate of time is based off of the original implementation project to standardize security infrastructure across data centers. These estimated duplicative costs would not be recovered through competition.

Without the aforementioned proprietary source code, no source other than Imperva and its authorized resellers can meet VA’s needs. System support is required to ensure the Imperva appliances in operation at IO remain up-to-date. Should support for the Imperva systems not be acquired, there is an immediate risk to IO’s network security posture. Gaps would exist within the software, thus not allowing full security visibility of the database and web application vulnerabilities on the network which could negatively impact the data stored on the VA network.

6. Efforts to Obtain Competition:

Market research was conducted, details of which are in Section 8 of this justification.

This effort did not yield any additional sources that can meet the Government’s

Imperva Hardware and Software Maintenance and Support VA-23-00022438 requirements. However, limited competition is viable among resellers for brand name Imperva software maintenance and support on the NASA SEWP V GWAC. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continually conduct market research by surveying the marketplace to determine if there are any other solutions that can meet VA’s needs.

8. Market Research: Imperva software maintenance and support is a commercially available off-the-shelf maintenance package currently in use in VA. The Government’s technical experts conducted market research in April 2023, by reviewing similar maintenance products including International Business Machines, AMP Tech Solutions and AppSecurity to ascertain if these items could meet VA’s requirements. Although other vendors possess similar capabilities to provide the required support and maintenance, only Imperva or one of it’s resellers has access to the proprietary source code, existing proprietary protocols, and software application programming interfaces specific to the support and maintenance required to support existing IO requirements and none of the other products could meet VA’s interoperability and compatibility requirements or avoid the estimated duplication of cost and time as outlined in Section 5 of this justification.

Additional market research was conducted by the Government in May 2023 to ascertain the extent of limited competition among resellers of the required Imperva software maintenance and support, wherein the Contract Specialist utilized the Provider Lookup tool on the NASA SEWP website. The research shows that there are a total of 10 Service-Disabled Veteran Owned Small Business contract holders identified as resellers of brand name Imperva that can fulfil the Government’s requirements.

9. Other Facts: None.