JA NBEKRSS SIGNED_Redacted.pdf

CONTROL NUMBER VA-26-00031146

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for the award of a firm-fixed-price (FFP) delivery order under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for renewal of brand name Zeva DecryptNaBox (Zeva) software maintenance and technical support services.

3. Description of the Supplies or Services: VA Office of Information & Technology (OIT), Infrastructure Operations (IO), has a requirement to renew maintenance and support for its existing brand name Zeva Network-based Encryption Key Recovery Storage Solution (NBEKRSS) Commercial-Off-The-Shelf (COTS) software solution. VA has utilized this brand name since fiscal year (FY) 2018 when VA initially competed and procured it. The deployed solution is comprised of brand name Zeva perpetual licenses, with annual renewal of the software maintenance and technical support services to ensure that the solution continues to perform to expected levels. The Zeva NBEKRSS COTS solution is a critical component of VA’s Public Key Infrastructure (PKI) ecosystem, supporting secure encryption key recovery, high-volume Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption, authorized operational investigations, records access, and eDiscovery workflows enterprise wide.

The existing brand name Zeva NBEKRSS COTS solution must maintain the ability to securely recover private keys associated with VA-issued encryption certificates, as required for authorized Freedom of Information Act (FOIA), litigation discovery, investigation, and records access workflows. VA’s PKI environment issues Federal Information Processing Standards (FIPS)-compliant X.509 certificates through the U.S.

Department of the Treasury Shared Service Provider (SSP) PKI, which hosts VA Certificate Authority (VACA) 1 and VACA2. These Certificate Authorities issue VA’s S/MIME Key Management certificates. NBEKRSS must support a minimum of 3.5 million encryption keys at any given time across the enterprise. This threshold reflects VA’s current enterprise operating requirement and is necessary to maintain uninterrupted key recovery coverage for VA-issued S/MIME encryption certificates.

Under this proposed action, the contractor shall continue to provide software maintenance which includes major releases, point releases, patch management, newly released features, service releases, security releases, and bug fixes. Further, 24x365 Help Desk Ticketing Support shall be provided, as well as supplemental telephonic support, from US-based personnel and facilities located within the Continental United States. Additionally, technical support services shall be provided to VA in the form of Authority to Operate (ATO) support, audit assistance, and evidence collection, and product and knowledge base documentation.

The Period of Performance shall consist of a 12-month base

4. Statutory Authority: Pursuant to Revolutionary Federal Acquisition Regulation Overhaul (RFO) Federal Acquisition Regulation (FAR) 16.507-6, the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of 41 U.S.C. 4106(c)(2), as implemented by RFO FAR 16.507-6(b)(2), entitled "Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized".

5. Rationale Supporting Use of Authority Cited Above: Based on the market research described in Section 8 of this justification, it was determined that only brand name Zeva maintenance and technical support can meet the Government's requirement. No alternate brand solution can meet all required functional and technical requirements, such as interoperability, security, performance, operational continuity, and ATO support to provide ongoing maintenance of this solution.

VA's NBEKRSS is built upon the brand name Zeva software platform which has been deployed within VA's on-premises infrastructure to meet unique federal and VA-specific security, PKI interoperability, and operational requirements. The proposed action is for renewal of the current deployed capability, and no augmentation of the existing footprint. The Zeva solution is integrated with the U.S. Treasury SSP PKI issuance environment, including VACA 1 and VACA2, and provides the capability to connect to and retrieve private key material from Entrust Security Manager Administration Certificate Authorities. This enables VA personnel to protect sensitive information and support mission critical operations. In maintaining compliance with federal directives, including the Freedom of Information Act (FOIA) and requirements for litigation discovery and records access, VA has a technical requirement for the capability to recover private keys associated with VA issued encryption certificates which no other vendor can provide. Private keys are escrowed within the PKI structure to support authorized decryption when necessary.

The solution to be renewed is integrated with VA's existing Luna T5000 Hardware Security Modules (HSMs), including PIN Entry Device (PED)-based key controls and has been configured and supported over time to meet Government requirements, including role-based access controls, immutable audit logging, FIPS 140-2/FIPS 140-3 validated cryptographic module integration, and high-throughput S/MIME decryption workflows of at least 50,000 email items per hour. The solution provides product specific evidence, NIST SP 800-53 control mapping support, architecture documentation, security-relevant technical information, and audit support, only Zeva or its authorized resellers can provide the required maintenance of this product-specific support for VA's Risk Management Framework (RMF) processes for the currently deployed solution.

Specifically, any responsible source that attempted to provide the required maintenance, for the brand name Zeva NBEKRSS COTS solution would require access to product-specific technical data and a validated integration path to ensure continued interoperability with VA’s deployed HSM configuration and key escrow architecture. VA does not possess proprietary rights, source code, or technical data to permit an alternative provider to maintain or patch the deployed Zeva software without the Original Equipment Manufacturer (OEM) authorization. Access to this proprietary source code is critical to develop and provide patches, fixes, updates, support, and maintenance so that any of these actions seamlessly interoperate with the deployed Zeva applications.

Specifically, the proprietary software code that the Zeva applications are based on has been continuously customized/enhanced through subsequent OEM driven updates/changes. Introduction of software code for maintenance that was not developed by Zeva is not viable, as it assumes first that the existing software can be manipulated to interact with the patch/push, but also introduces intolerable risk that data may be lost, corrupted, or inaccurate as a result of that non-Zeva brand code. This results in introducing unnecessary security, privacy, and security vulnerability risks without a way to mitigate the risk. Additionally, without access to this proprietary source code, no other source would be able to perform investigative or patching work to remediate vulnerabilities or issues, which would require review of the source code to perform branching/alteration, and then the ability to push those updates seamlessly to the Enterprise. Additionally, VA has a requirement to maintain the existing ATO for the Zeva NBEKRSS COTS solution, which includes performance of testing, updates and remediation of findings. As such, in order for a responsible source to fulfill this requirement, it would need access to the proprietary source code, in order to perform the testing, identify root cause, and ultimately remediate any potential vulnerabilities identified in the scanning/testing process. Zeva is the only source that can meet this technical requirement, and without maintenance support from Zeva, the current applications could be rendered unusable/inoperable.

The only way another source could provide the required maintenance services would be to wholistically remove and replace the Zeva NBEKRSS COTS solution. This is not viable based on market research; VA did not identify any alternative solution that demonstrated operational capability to perform this function within VA’s deployed environment. For instance, alternative sources lacked the capability to retrieve private key material from the U.S. Treasury SSP PKI VACA1/VACA2 and Entrust Security Manager Administration CA environment, which are baseline requirements for a solution.

The current solution supports a minimum of 3.5 million encryption keys across the VA enterprise. Disruption to, or replacement of, this solution under the renewal action would require the complete removal of the existing solution, testing, training, security/compliance (Authority to Operate) and re-deployment of another solution.

Additionally, an alternate solution would impair VA’s ability to fulfill authorized FOIA, litigation discovery, investigation, records access, and cybersecurity operations.

Further, it was determined that based on the complexity and scale of the NBEKRSS environment, VA estimates that it would take approximately 3 years to meet all functional and technical requirements for the replacement. For instance, VA would also then need to ensure security testing, operational testing, data validation, administrator training, RMF documentation updates, A TO/Authority to Use review, and parallel operation of the incumbent environment to avoid mission degradation and or interruption while also migrating data. An example of the necessary time to complete these steps would include the estimate of 3-9 months to develop/test/integrate the VACA requirements, interface develo ment and mi ration lannin which is ·ust one com onent of these re uired ste s.

Without continued brand name Zeva DecryptNaBox maintenance and support, the system will become unsupported or inoperable, leaving VA without an approved operational capability to decrypt required encrypted communications and documents.

VA must maintain continuity of its currently deployed NBEKRSS without interruption to meet mission-critical FOIA, litigation discovery, authorized investigation, records access, and enterprise S/MIME decryption workflows. As such, VA must renew the maintenance and support of the VA owned software as proposed.

6. Efforts to Obtain Competition: Market research was conducted, as described in Section 8 of this justification. This effort did not yield any additional sources that could meet the Government's requirements without material redevelopment, integration, testing, transition, and reauthorization risk. However, the VA technical representative determined that limited competition is available among authorized resellers for the software maintenance and technical support. Accordingly, VA will seek competition to the maximum extent practicable for the required brand name Zeva DecryptNaBox, maintenance, and support. VA will continue to monitor market trends, new/emerging products, and services for availability of other solutions to meet VA needs. In accordance with RFO FAR 16.507-?(c)(ii) this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

7. Actions to Increase Competition: The Government will continue to conduct market research to determine whether future requirements can be competed more broadly and whether alternative commercial solutions will become available in the market that can satisfy VA's technical and functional requirements.

8. Market Research: Market research was conducted by VA technical experts in March and April 2026 via two Request for Information (RFI) actions that were issued to SAM.gov and NASA SEWP V RFI. The RFls requested information from potential sources on alternative OEM solutions technical capability, availability, implementation approaches, contractual vehicle availability/reselling and rough orders of magnitude.

Eight (8) vendors responded to the RFI, and of the eight (8) respondents, five (5) of them (Patriot Allied Solutions LLC; V3Gate; Zeva Incorporated; METGREEN Solutions;

and Carahsoft Technology) proposed the brand name Zeva DecryptNaBox COTS solution and were considered as technically capable of meeting the Government's requirements as authorized resellers or the OEM itself. The remaining three (3) respondents (Fortanix, Tegminestar LLC, and RV Global Solutions Inc), are not able to provide the necessary functional and technical requirements to be considered as an alternative solution, nor can they seamlessly integrate with the existing brand name Zeva DecryptNaBox COTS solution, as they do not have access to the proprietary source code, and product-specific technical data. Based on the market research, VA technical experts determined that alternatives did not demonstrate current capability to meet all of VA’s technical and interoperability requirements for the deployed NBEKRSS environment.

The RFI responses confirmed there are multiple technically capable authorized resellers, including Service-Disabled Veteran-Owned Small Businesses (SDVOSBs), capable of participating in this acquisition under the North American Industry Classification System 541519 as authorized sources for the Zeva DecryptNaBox solution. Accordingly, VA intends to compete the brand name requirement among authorized sources to the maximum extent practicable. Based on the above market research, VA technical experts determined that only brand name Zeva DecryptNaBox associated maintenance and support services, available through Zeva Inc. or authorized resellers, can meet all of VA’s current technical, interoperability, security, ATO, and operational continuity requirements for NBEKRSS without additional development risk, schedule delay, or mission disruption.

9. Other Facts: None.

Technical/Requirements Certification

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Fair and Reasonable Cost Determination

I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on based on comparison of proposed price to historical data for the same or similar items, the proposed pricing for to the published catalog and published price indices under NASA SEWP V GWAC. Finally, the successful quote will be compared to the Independent Government Cost Estimate.

Contracting Officer Certification

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Advocate for Competition Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for renewal of brand name Zeva DecryptNaBox software maintenance and technical support services on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.