JA REDACTED.pdf

Quest Change Auditor Software Control Number: VA-21-00035343

JUSTIFICATION AND APPROVAL

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for brand name Change Auditor software.

3. Description of Supplies or Services: VA, Office of Information and Technology (OIT), Service Delivery and Engineering, Enterprise Systems Engineering has a requirement to renew 531,050 Quest Change Auditor software licenses and procure 68,950 new licenses for a total of 600,000 VA-owned Quest Change Auditor software licenses to support the Microsoft Active Directory (AD) environment managed in VA domain controller hardware which will allow VA to continue to account for historical growth over the previous three years. Change Auditor software allows for monitoring of various AD changes. It alerts VA on suspicious activity that could be a sign of a bad attacker attack.

The software licenses are currently installed on servers within the VA enterprise supporting Microsoft AD. Quest Change Auditor for AD is an auditing tool that tracks, reports, and provides alerts of configuration changes to the Microsoft AD in real time.

The required maintenance support includes software upgrades, troubleshooting, break-fix repair, and technical support. The maintenance ensures the software remains operational throughout its use. The period of performance shall consist of a base year from April 15, 2021 to April 14, 2022, four option periods for continued licensing and maintenance, and an optional task for transition services including migration of the most current/historical Quest Change Auditor Database. This brand name software is required to audit, monitor, and report on the Microsoft AD for at a minimum the next five years to ensure full security coverage and eDiscovery for anticipated VA AD Modernization IT projects. Additionally, no changes to the AD auditing/monitoring infrastructure are anticipated in that time. The total estimated value of the proposed action is $3,497,714.40 (inclusive of all option periods and the optional task).

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i nly one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are uniqu

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, it was determined that limited competition is viable among NASA SEWP V GWAC resellers. No other brand of software is able to

Quest Change Auditor Software Control Number VA-21-00035343 interoperate with the current AD auditing/monitoring infrastructure which currently operates/communicates with of 531,050 Quest Change Auditor software licenses. The current auditing/monitoring infrastructure is developed and configured to interoperate with Quest Change Auditor software. Due to the Quest proprietary source code, no other brand name monitoring software can interoperate with the existing infrastructure without significant re-configuration and re-development including replacing agents on 577 domain controllers and replacing software clients on nine servers. No other software product is interoperable or compatible with the currently fielded infrastructure.

This requirement is not to replace the existing auditing/monitoring infrastructure, which currently interoperates with Quest Change Auditor software. Replacing the existing infrastructure will result in a duplication of effort that will not be recuperated through competition. Based on market research and previous efforts, replacement of the infrastructure would result in unnecessary and duplicated costs of approximately $1.2 million and a period of 12 months to reconstitute the new auditing/monitoring environment.

Additionally, all data collected to date will be unusable in the current format as it cannot be migrated to a new database and the database design is proprietary to Quest and no other auditing software will be able to access the archived data from the Quest database. Even if an alternative vendor could potentially migrate the data, it would necessitate the vendor to develop and code a program to transport the data of multiple millions of records which have captured data points for the entire VA over the last 3 years. Due to the sheer volume of the data retained over the last 3 years, there is a large risk of data corruption issues with such a large scale migration which could compromise data or cause loss of data critical to administrative or criminal investigations within VA. This data is used in the auditing and monitoring of the AD and allows VA to retrieve historic data that is useful in seeing trends of unwarranted changes in AD. VA has a requirement that any auditing software used in its current infrastructure block access to the windows security logs to any individual without privileges to those logs. VA Directive 6500, VA Cybersecurity Program, requires a continuous data monitoring capability be established and maintained as specified in National Institute of Standards and Technology (NIST) Special Publication (SP) 800- 800-137 that provides cohesive collection, transmission, storage, aggregation, information sharing and presentation of data that conveys current operational status to affected VA stakeholders ederal and industry partners.

Finally, Quest or its resellers are the only sources that can provide the required maintenance for the Quest Change Auditor software supporting Microsoft AD. No other source is capable of providing the required maintenance, as only Quest or its resellers possess the proprietary technical data for the Change Auditor software. This technical data allows source code level access to the fundamental elements of the software which is essential for technical support, software version control, and updates.

It is critical to OIT that the aforementioned software licenses are maintained and updated. The brand name Quest Change Auditor software performs correlations between the change in Microsoft AD and the user granting or removing privileges in which other built-in or VA owned tools do not provide. Failure to procure and maintain the required brand name auditing software and maintenance support will prohibit VA s ability to monitor, audit, and report on events in the AD and present a significant security risk to the VA infrastructure. A change in the monitoring software and infrastructure would result in a disruption in the monitoring of a VA high value asset putting the infrastructure at risk. Without continuous and interrupted monitoring, VA is at risk of attacks going undetected for a longer period of time causing harm to the VA network.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Item 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for this brand name. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: Although the Government is limiting competition as a result of specifying a brand name, there are authorized resellers of these products on the NASA SEWP V contract. Competition for this requirement among these vendors is anticipated. In order to remove barrier to competition for future acquisitions, the agency will work with the program office to perform additional market research to consider alternate software solutions. Furthermore, the Government anticipates award of an optional task in the resulting delivery order to provide a means to transition VA Data by migrating the most current/historical Quest Change Auditor Database to a useable format that can easily be migrated to another auditing platform should that become necessary in the future modernization of VA.

8. Market Research: Market research was conducted in December 2020 to determine whether any other source can provide the software and maintenance support required to meet the Governmen s n ical experts researched software and maintenance support service plans offered by similar providers such as Manage Engine (AdAudit Plus), Netwrix (AD Auditor), and BeyondTrust (AD Auditing) to determine if any were capable of meeting the Governme oftware interoperability and functional requirements. After reviewing these other software products, the Governmen erts determined that none of these items could need due to the interoperability and compatibility requirements and the ability to access the current archiving database. discussed in paragraph 5 of this justification. Market research determined that although these companies and their software products could provide similar maintenance support for their competing products, they could not access proprietary Quest Change Auditor for AD software required to provide the necessary maintenance services. Only Quest and its resellers have access to the proprietary technical data for the Quest Change Auditor licenses to provide maintenance and support the AD environment.

On February 4, 2021 additional market research was conducted by utilizing the NASA SEWP V GWAC Provider Look-up Tool which confirmed that there are multiple resellers of the brand name Quest Change Auditor software licenses on the NASA SEWP V GWAC, including several Service-Disabled Veteran Owned Small Businesses (SDVOSBs). Based on the analysis of the response, along with the NASA SEWP V GWAC Provider Look-up Tool results, there is a reasonable expectation that limited competition exists on the NASA SEWP V GWAC for the required brand name Quest Change Auditor software. As a result of the aforementioned market research, VA intends to issue a Request for Quotation targeted to Vendor Information Page (VIP) verified SDVOSB SEWP V Group B(2) GWAC holders.

9. Other Facts: N/A

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Quest Change Auditor Software on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.