JA_PaloAlto_FINALRedacted.pdf

Palo Alto Network Firewall Security Equipment Control Number: VA-21-00078428

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed-priced delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC), for brand name Palo Alto Networks, Inc. (Palo Alto) firewall security equipment, Premium Support, and Threat Prevention service subscriptions at the Veterans Integrated Service Network (VISN).

3. Description of Supplies or Services: The Department of Veterans Affairs (VA) Office of Electronic Health Record Modernization (OEHRM) requires brand name Palo Alto Networks firewall security equipment, Premium Support, and Threat Prevention software subscriptions. These requirements do not include any type of product development or installation services. There are approximately 674 Palo Alto firewalls deployed in 337 VA Medical Centers (VAMC)/Clinics to facilitate their secure connectivity to the Cerner data center and access to the new Electronic Health Record (EHR). OEHRM is securely connecting VAMCs and Clinics to the Cerner data center where the EHR solution is being hosted. The hosting environment is jointly managed by the Department of Defense (DoD) and VA. To comply with the 2008 National Defense Authorization Act, which requires DoD and VA interoperability of health record systems, the VA and DoD are implementing a jointly managed EHR using Cerner’s Millennium solution. This solution is hosted in the Cerner Data Center. Access to the jointly managed EHR is achieved by connecting to the DoD’s Medical Community of Interest (MedCOI) network. MedCOI is a virtual network with detailed technical specifications and operational procedures implemented to ensure privacy of protected health information as required by the Health Insurance Portability and Accountability Act of 1996 and other federal laws and regulations.

The joint management of the EHR requires, in part, that DoD and VA work together to ensure operational availability, performance and security of the infrastructure supporting the EHR. In furtherance of this requirement, on February 13, 2018, the VA and DoD signed the DoD/VA Joint Electronic Health Record Architecture Description, which established the common security architecture for VAMCs/Clinics and MedCOI connecting to the EHR system. This common architecture, known as the Joint Security Architecture (JSA), enables the VA and DoD to create a common management environment allowing each organization to meet its obligations for availability, performance, and security within its domain of control while having visibility into the partner organization’s domain of control. The Palo Alto firewalls are part of the existing JSA implementation and common management environment. The existing security architecture is managed and administered through a Palo Alto Panorama Management console which provides the common management environment. Communications between Panorama and the firewalls are proprietary to Palo Alto.

The Palo Alto Networks firewalls, Premium Support and Threat Prevention subscriptions shall be used to support the migration of multiple VISN sites from the Veterans Health Information Systems and Technology Architecture to the new EHR. Premium Support, a 3-year subscription, includes access to the online support portal and 24 x 7 x 365 phone and email support that VA firewall administrators use for installation support, parts replacement, software fixes and implementing feature releases. In addition, the 3-year Threat Prevention subscription works in conjunction with Panorama, the Palo Alto Management system, to provide proprietary cloud-based services, an intrusion prevention system, and software analytical tools to protect the VA enterprise from multiple threats and network attacks. The period of performance for this action is 36 months from date of award. The total estimated price of the proposed base action is $26,449,992.80 to procure 1540 Palo Alto firewalls and associated Premium Support and Threat Prevention subscriptions to deploy in approximately 15 VAMCs/Clinics. All hardware will be delivered within 30 days after date of award. Optional quantities are included to procure up to 148 additional Palo Alto firewalls and associated Premium Support and Threat Prevention subscriptions. The optional quantities may be exercised at any time within 12 months after date of award up to the not to exceed maximum quantity. Including all optional quantities, the total estimated value of the action is $28,991,940.16.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Item 8 of this justification, it was determined that limited competition is available among resellers for this requirement. The Palo Alto firewalls are part of the existing JSA implementation and common management environment. The existing security architecture is managed and administered through a Palo Alto Panorama Management console which provides the common management environment.

Communications between Panorama and the firewalls are proprietary to Palo Alto. The configuration language is proprietary to Panorama and cannot be replicated by other Original Equipment Manufacturers (OEM) as it relies on proprietary software.

Additionally, the security event reporting language is also proprietary to Palo Alto as it also relies on Palo Alto proprietary software.

Panorama is used to manage and configure all VA Palo Alto firewalls centrally through a browser-based interface. The centralized management also provides for the distribution of software updates and real-time changes to firewall rules and policy editing to accommodate new vulnerabilities. In addition, the centralized management capability in

Panorama significantly removes firewall issues caused by misconfiguration. Once a configuration is tested and accepted, it can be loaded and distributed to all firewalls in the Panorama node. Furthermore, as firewalls capture information in logs on source and destination internet protocol addresses, protocols and port numbers used to help the DoD/VA investigate an attack, Panorama aggregates the logs and creates a single display for actionable visibility across multiple firewalls, no matter where they are deployed. No other OEM’s firewalls can interoperate with the Panorama management console with the same configuration and event reporting functionality. Further, no other OEM’s management platform can manage VA and DoD’s Palo Alto firewalls. Using another OEM’s firewall will require both VA and DoD to redesign and reimplement the JSA. VA cannot require the DoD to redesign and reimplement the JSA; therefore, this requirement must operate with the existing architecture or environment which is structured around the Panorama console, therefore only Palo Alto firewalls meet the VA’s requirement for a common management environment. Furthermore, the support and threat prevention software are only interoperable with the Palo Alto firewalls and as such can only be provided by Palo Alto or a reseller. Failure to procure Palo Alto firewalls will negatively impact the deployment and go-live schedule developed for VAMCs/Clinics at VISN sites to connect securely to the Cerner data center and access the EHR, placing the VA in the posture of violating the “2008 National Defense Authorization Act”, and adversely affect the ability of healthcare workers at the VAMCs/Clinics to provide proper healthcare to Veterans if they are not connected to the Cerner data and thus don’t have access to the EHR.

6. Efforts to Obtain Competition: Market Research was conducted, details of which are in Item 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical experts determined that limited competition is available among authorized resellers for brand name Palo Alto firewalls. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, OEHRM will continue to monitor market trends and new/emerging products, looking for compatible and more advanced technologies to meet VA needs.

8. Market Research: In May 2021, VA technical experts reviewed similar products to Palo Alto Networks products, to include those from Fortinet and Cisco. While other networking hardware and software solutions from alternative manufacturers exist, they do not meet VA’s requirements as outlined in Section 5 of this Justification, because only Palo Alto Networks or a reseller have access to the proprietary communication protocol that the Panorama central management software uses to manage the Palo Alto firewalls currently in place across VA. In addition, VA technical experts regularly review industry trade publications and conduct internet research to ascertain if any other brand name equipment is available. Market research revealed that only Palo Alto Firewalls support and software can be added to the VA’s infrastructure without disrupting the existing architecture and environments.

Furthermore, Request for Information (RFI) #197401 was issued on June 11, 2021 on the NASA SEWP V GWAC website to ascertain if there were resellers that could meet the Government’s requirements for brand name Palo Alto firewall security equipment, Premium Support, and Threat Prevention service subscriptions. The RFI closed on June 18, 2021, and two Palo Alto resellers provided quotes: MetGreen Solutions and Veteran Information Technologies. No alternative solutions were proposed. Both contract holders who provided quotes are Service-Disabled Veteran-Owned Small Businesses (SDVOSB). Additional market research was conducted in July 2021 by the Contract Specialist utilizing the Provider Lookup tool on the NASA SEWP V GWAC website which identified several resellers of the required brand name Palo Alto equipment, support and software including multiple SDVOSB contract holders.

Based on the market research efforts, the Government’s technical experts have determined that only brand name Palo Alto firewall security equipment, Premium Support and Threat Prevention software subscriptions can meet all the VA’s needs.

Market research determined that limited competition is viable among resellers for the brand name Palo Alto Networks products.

9. Other Facts: None

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Daniel J. Mesimer Date: 8/17/2021

Denise L. McLain 269879

Digitally signed by Denise L.

McLain 269879 Date: 2021.08.17 15:15:44

Director WAN/LAN Infrastructure Signature:

Engineering & Provisioning

-05'00'

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable.

Prices contained in contracts awarded on NASA SEWP V GWAC have already been determined to be fair and reasonable. Additionally, price competition is anticipated to secure discounts from existing contract prices and the lowest price quote that conforms to the solicitation requirements shall be compared to the Independent Government Cost Estimate.

Juan Quinones Date: 8/18/2021

JUAN C.

Digitally signed by JUAN C.

QUINONES 165185

Contracting Officer Signature: QUINONES 165185 Date: 2021.08.18 08:36:58 -04'00'

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Juan Quinones Date: 8/18/2021

JUAN C.

Digitally signed by JUAN C.

QUINONES 165185

Contracting Officer Signature: QUINONES 165185 Date: 2021.08.18 08:41:58 -04'00'

Approval

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby approve the acquisition of brand name Palo Alto firewall security equipment, Premium Support and Threat Prevention software subscriptions at multiple VISN VAMCs on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: Signature:

Michele R. Foster Head of the Contracting Activity Technology Acquisition Center Office of Procurement, Acquisition, and Logistics