JA - OpenText Fortify SAC.pdf

OpenText Maintenance and Support CONTROL NUMBER VA-26-00011436 providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this justification, it was determined that limited competition is available among resellers. The current SWA static analysis process is based on existing OpenText Fortify SCA software, and VA requires maintenance and support for its 4,080 OpenText Fortify SCA licenses compatible with the existing software protocols and functionality for continued operational availability. OpenText Fortify SCA software is proprietary software; therefore, no other software maintenance provider has the proprietary code required to perform the necessary maintenance support. OpenText has the proprietary rights to the software. Based on current market research, only OpenText or its resellers can provide the necessary software maintenance support because of the proprietary source code required to develop and implement current software updates.

Without access to the proprietary source code, existing proprietary database structures, protocols, software application programming interfaces, and software, updates cannot be installed. This would result in VA software development teams functioning with outdated and unsupportable software versions. Operating with outdated and unsupportable software will result in loss of functionality to the end users utilizing the source code static analysis tool. Specifically, it will adversely affect VA’s ability to issue authorizations to operate (ATO). Based on previous acquisition history, it is estimated that duplicated costs to replace VA’s existing 4,080 perpetual OpenText Fortify SCA software licenses with a new static analysis solution providing equivalent functionality would cost approximately $12,075,795.03.

Failure to continue maintenance and support for VA-owned OpenText Fortify SCA software would have significant adverse effects on VA’s operations. Should the required support not be continued, existing proprietary database structures, protocols, software application programming interfaces and software updates cannot be installed. This would result in VA software development teams functioning with an outdated and unsupportable software version, leading to potential disruptions in their workflow and delays in project timelines. This would hinder the timely development and deployment of critical applications. Operating with outdated and unsupportable software will result in providing less functionality to the end users utilizing the source code OpenText Fortify SCA tool. Specifically, it will adversely affect VA’s ability to issue ATO as this tool is regularly used throughout the software development life cycle minimizing the risk that a serious problem goes undetected prior to going into deployment. The VA OIT Certification Program Office relies on the OpenText Fortify SCA tool for Assessment and Authorization activities. Without proper maintenance, the tool may fail to meet compliance standards, jeopardizing VA’s ability to issue necessary ATO. This would significantly impact VA’s software development life cycle, as the inability to issue ATOs would prevent new software from being deployed, thereby stalling critical projects.

Operating with outdated software could lead to higher long-term costs. VA may need to invest in emergency fixes, additional security measures, or even replacement software, which would be more costly than maintaining the current system. The lack of regular software updates and rule pack updates would expose VA’s systems to security vulnerabilities. This increases the risk of cyber-attacks and data breaches, potentially compromising sensitive Veteran information. Ultimately, any disruption or delay in VA’s software development and deployment processes could negatively impact the services provided to Veterans. Ensuring the continuous operation of the OpenText Fortify SCA software is crucial for maintaining the quality and reliability of VA’s services.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that could meet the Government’s requirements. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government Subject Matter Experts( SMEs) conducted market research of similar software maintenance solutions via web-based research in September 2025. The solutions reviewed included SonarQube, Checkmarx, Veracode, and CAST Application Intelligence Platform. However, due to the proprietary data and code of the OpenText Fortify Software these similar vendors are unable to provide the required maintenance of the VA owned perpetual software licenses.

Fortify’s proprietary rule packs, data structures, and integrations can only be maintained by the original developer or an authorized reseller. Renewing maintenance preserves operational stability and avoids unnecessary disruption, retraining, and risk that would accompany adoption of a new SAST product. This action is limited to ongoing maintenance and support of VA owned Licenses.

On September 17, 2025, VA conducted market research using the NASA SEWP V GWAC Provider Lookup Tool. This identified 118 potential capable sources able to provide the OpenText Fortify SCA brand name software, including 21 Service-Disabled Veteran-Owned Small Business resellers. This confirmed that the requirement could be supported under the SEWP contract vehicle with limited competition available.

On September 18, 2025, a Market Research Request was posted on SEWP under RFI #36049. On September 24, 2025, the RFI closed, and a total of nine (9) responses were received, including five (5) from SDVOSBs. While these responses confirmed reseller availability for the brand name requirement, only the OpenText Fortify SCA OEM and its resellers can provide maintenance and support for the OpenText Fortify SCA product.

One offeror proposed an alternative solution; however, it was found technically unacceptable as it couldn’t provide maintenance and updates for VA’s existing 4,080 Fortify SCA perpetual licenses. On November 5, 2025, the VA closed the loop with the offeror.

The combined results of the SEWP Provider Lookup, SEWP RFI responses, and online market research established that only OpenText Fortify SCA brand name maintenance can meet VA’s requirements. Migration to an alternative tool would result in excessive duplication of costs, operational disruption, retraining requirements, and compliance risks as discussed above.

9. Other Facts: None.

10. Technical/Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among NASA SEWP V GWAC holders.

Additionally, NASA SEWP determines that all catalog prices on its GWAC’s are fair and reasonable. Additional price analysis may be performed in accordance with FAR 15.404-1(b). Finally, price analysis shall be conducted by comparing the successful quote to the Independent Government Cost Estimate.

12. Contracting Officer Certification/: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of OpenText Fortify Static Code Analyzer software maintenance and support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.