JA_Justification ForeScout final_Redacted.pdf

36C10B24Q0451

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center 1701 Directors Blvd., Suite 600 Austin, TX 78744

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for the procurement of maintenance and technical support for ForeScout hardware.

3. Description of Supplies or Services: VA Office of Information and Technology, Information Technology Operations and Services, Infrastructure Operations (IO) has a requirement for brand name ForeScout hardware maintenance and technical support via telephone, e-mail, or internet to troubleshoot malfunctioning equipment/components or provide replacement equipment/components that restore full operation and accessibility to the original redundant component configuration.

Initial response to all requests for maintenance shall be initiated within one hour of the initial notification from VA. Additionally, hardware maintenance shall consist of firmware upgrades, updates to include major releases, point releases, service releases and security releases of applicable firmware on a quarterly basis, and/or within 48 hours in cases where a high-risk vulnerability fix becomes available. The maintenance is required to ensure the hardware remains operational. The period of performance shall be 12-months. The total estimate price of this action is

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart

16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”

5. Rationale Supporting Use of Authority Cited: Based on market research, as described in section 8 of this document, it was determined that limited competition is available among authorized resellers for this requirement. The current VA IO infrastructure is comprised of existing proprietary ForeScout hardware, for which VA requires support and maintenance that will be compatible with the existing infrastructure protocols and functionality for continued operational availability. These existing, in-use, ForeScout devices located at five IO data centers can only interoperate and communicate with other brand name ForeScout devices through proprietary source code. Due to this proprietary ForeScout code, no other brand of hardware maintenance and technical support will be able to deliver compatible and seamlessly interoperable fixes/updates to the current brand name ForeScout infrastructure. Specifically, both the administrative control interface, which controls the network visibility fabric, and the physical device interfaces for clustering and load balancing are proprietary to ForeScout, allowing for the integration into the existing ForeScout infrastructure across the Enterprise, which consists of approximately 250 sites. As such, a responsible source for the required hardware maintenance and technical support must have access to the proprietary source code to develop, test and push patches, updates and functionality through the fabric manager that will seamlessly interoperate with this infrastructure. The fabric manager is essential to supporting this infrastructure as it manages, implements, and allows VA to view the firmware version of the code in use for the current ForeScout infrastructure, and permits detection of any issues there may be with the ForeScout equipment and software. Introduction of push/patch/update not developed by ForeScout or its authorized resellers creates unacceptable risk to the entire environment.

Additionally, without access to the proprietary source code, a vendor cannot test/validate full functionally or how the patch will interact with the rest of the deployed system. For instance, if there was an issue with a patch/update, and it was not seamlessly interoperable, it could create an unknown vulnerability to the entire system that would have otherwise been avoided. Furthermore, a responsible source must be an authorized reseller of the brand name services to have access to replacement parts that are proprietary to ForeScout to meet form, fit, and function of the existing solution.

Due to these proprietary constraints, the use of any alternative vendor maintenance and technical support services will necessitate a complete replacement of the existing ForeScout infrastructure in place. The VA’s current investment is approximately for the existing ForeScout infrastructure, training, and travel time. This figure does not account for the two-year time investment needed for VA engineering design, testing, procedure development, and implementation that would be required for a new product. No other hardware maintenance is compatible with or interoperable with the existing ForeScout hardware.

Failure to acquire ForeScout maintenance and technical support as proposed would leave VA with inhibited ability to perform its security mission, reducing the agencies capability to monitoring and identifying potential threats. Only the proposed brand name ForeScout products will meet the requirements to integrate and interoperate with the existing ForeScout-based infrastructure.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research paragraph of this document. This effort did not yield any additional sources that can meet the Government’s requirements. However, it was determined that limited competition is viable among authorized resellers for this brand name hardware maintenance. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove barriers to competition in future acquisitions for this requirement, the agency will work with the program office to perform additional market research so that other solutions can be considered.

8. Market Research: In February 2024, Government technical subject matter experts (SMEs) conducted web-based market research to ascertain if any other non-proprietary but fully compatible and functional hardware maintenance and technical support is available. VA SMEs compared hardware maintenance and technical support from various vendors such as CommView and Solar Winds Netflow who have similar offerings and determined that none have access to the proprietary source code required to maintain the existing ForeScout infrastructure. No other manufacturer has the capability of developing and issuing hardware maintenance for ForeScout to support existing IO requirements. The products researched were unable to meet the functional requirements and integration with existing installed hardware and no other product other than ForeScout hardware maintenance and technical support are able to meet these requirements. Additionally, hardware maintenance from any other provider except ForeScout would not meet VA’s interoperability and compatibility requirements outlined in paragraph 5 of this document. Only ForeScout hardware maintenance and technical support meets all of the Government’s requirements.

Additional market research was performed in February 2024 utilizing the NASA SEWP V GWAC Provider Lookup tool, which resulted in the identification of 30 SDVOSB resellers of the required ForeScout hardware. As a result, there is a reasonable expectation for limited competition on the NASA SEWP V GWAC.

In May 2024, the Contract Specialist conducted additional market research using the NASA SEWP V Provider Lookup Tool to ascertain the extent of limited competition among resellers of the required brand name ForeScout products. Through the use of the Provider Look-Up Tool on the NASA SEWP V GWAC website, 6 Service-Disabled Veteran-Owned Small Businesses were identified as authorized resellers of the required brand name ForeScout products. Based on this market research, limited competition is anticipated.

9. Other Facts: N/A

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on NASA SEWP GWAC prices already being determined to be fair and reasonable.

Additional price competition is expected among resellers for this action.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.