JA_ rfq.pdf

Risk Management Framework - RedSeal ID# 36C10B-20-AP-1435

JUSTIFICATION AND APPROVAL

FOR EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a Firm-Fixed Price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V, Government Wide Acquisition Contract (GWAC) for brand name RedSeal subscription licensing, engineering support, training, hardware and software licensing, maintenance and installation upgrades for the architecture, and implementation and integration need for the cloud. Hosting will be provided by VA.

3. Description of Supplies or Services: Department of Veterans Affairs (VA), Office of Information and Technology, Office of Cyber Security, has a requirement for brand name RedSeal products and services required to refresh existing end-of-life and increase capacity of appliances (quantity of 1 in the base Period; 2 in Option Period One; 1 in Option Period Two; and 1 in Option Period Three for a total of 5) and RedSeal subscription license renewal for unlimited Layer 2, Layer 3, and firewall network devices, which includes cloud infrastructure licensing coverage. The vendor will also provide engineering support, training, hardware and software maintenance, and installation upgrades for the architecture, implementation, and integration needs for the cloud. Hosting will be provided by VA. The licensing and hardware from RedSeal will enable VA Office of Cyber Security to continue its robust vulnerability detection architecture for its networks, through its integration with firewall and network devices and the Enterprise Mission Assurance Support Service (eMASS) which is a Government off-the-shelf solution that automates a broad range of services for comprehensive, fully-integrated cybersecurity management, including controls, scorecard measurement, dashboard reporting, and the generation of Risk Management Framework package reports. The services consist of: training VA staff to manage and use the analytics for the software dashboard; support services for two technical engineers who will assist the VA in the collection analysis in the reporting of data; and hardware and software maintenance which consists of product updates and replacement parts. The period of performance shall consist of a 12-month base period with four 12-month option periods. The total estimated cost of this acquisition is $39,763,034.55, inclusive of four (4) option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this document, it was determined that limited competition is available among authorized resellers for the required brand name RedSeal products.

Since the initial pilot completed in November 2014, RedSeal has provided seamless integration into all VA’s multi-tiered risk and vulnerability detection architecture.

RedSeal delivers real-time network vitalization that can detect, document, and provide actionable intelligence to information system owners on critical risks located on networked equipment. RedSeal provides Federal regulatory compliance with Federal Information Security Management Act requirements as well as Secure Technical Implementation Guides both required by VA. RedSeal is currently the only product within VA that integrates, supports and is deployed with VA’s Enterprise Mission Assurance Support Service (eMASS) current Governance Risk Compliance (GRC) tool. VA estimates the lifecycle/utilization of the GRC tool to be an additional 10 years based on its current forward design functionality and architecture support framework. This estimate is based on the current Defense Information System Agency’s interagency agreement and the lifecycle plan for the eMASS platform.

GRC is the tool VA uses for their Assessment and Authorization program to document security controls, risks, vulnerabilities, and to document and issue Authorizations to Operate. GRC consists of modules for compliance, assets, threats and vulnerabilities, policy, and reporting. GRC requires that reports from the installed cybersecurity solution provide metrics by system boundary to the device level to show overall and downstream risk. Only the RedSeal device and software (with licenses) can provide such functionality passively. Providing this functionality passively is a critical VA functional requirement. RedSeal is the only product that eliminates the need to deploy a credentialed monitoring agent on the network device for use in traversing communication paths across VA’s network. The deployment of a credentialed monitoring agent carries inherent risks that are unacceptable to the VA. The use of any other solution, which would require allowing additional agents credentialed access to network devices increases the risk of threats and vulnerabilities on the device and may require re-Accreditation of those infrastructure systems, and as such will not meet the Governments requirement.

Further, even if another solution existed that could meet VA’s requirements, RedSeal is the only product that is currently integrated in VA into eMASS and VA’s GRC tool.

Eliminating RedSeal from eMASS will require a newly architected solution that will result in additional cost to VA and additional support for a new hosted environment. Any investment in an alternative product would require an estimated $40 million dollars for procurement, reengineering, and training. This estimate does not include the additional estimated cost of approximately $20 million dollars over a three-year period necessary to maintain use of the RedSeal product in parallel while the alternative product was integrated, tested, and training was provided to end-users. These estimates have been developed using previous acquisition history.

RedSeal is the only source capable of providing the hardware, implementation support and software maintenance for already-deployed Layer 3 RedSeal products.

RedSeal is deployed without Credential Authentication on Layer 3 network devices, which reduces the deployment effort and maintenance on VA’s network appliances.

In addition, only the RedSeal solution meets the requirement for passive operation for Layer 2. As more fully described in Section 8 below, RedSeal was the only solution that met both the technical requirements and the need of a large-scale enterprise. Finally, only RedSeal or an authorized reseller can provide the service under this proposed action since access to the RedSeal proprietary code is required. No other original equipment manufacturer has access to the RedSeal proprietary source code that is needed to provide the required services. Access to this code is required to ensure all the services provided are properly configured.

Additionally, the RedSeal production instance augments use of RedSeal with enterprise unlimited endpoints and additional VA Enterprise Cloud visibility/analytics VA RedSeal infrastructure. Infrastructure and architecture functionality restrictions exist where only additional RedSeal brand name can meet existing VA’s RedSeal’s central management, licensing model. The current RedSeal infrastructure supports the ongoing VA technical requirements of agentless, appliance based, no administrator overhead dependencies. Only through continuing the established invasive security architecture with maximum visibility and expedited near real-time IT Security vulnerability threat modeling will allow critical risk reviews and responses to take place and enable VA to understand potential threats to VA systems.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name RedSeal, as well as software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace or VA’s enterprise and architectural posture that would enable future actions to be competed.

8. Market Research: The Government’s technical experts conducted market research via internet search February - April 2020. The experts reviewed products including Tufin, AlgoSec, and FireMon. Government technical experts concluded that Tufin and AlgoSec do not have the capability to be deployed and integrated with eMASS, the capability to provide network visualization and mapping, and to be deployed with additional constraints and efforts of VA staff. FireMon could not be deployed as it would require a separate supporting, hosted environment and would require the deployment of additional resources on network devices to support credential access. VA cannot accept the risk of credentialed live access to network devices and the extra network traffic that would ensue. From the review it was determined that the vendors capabilities remain unable to meet VA’s current Risk Management requirements. Therefore, it was determined that RedSeal is the only product that can be used without the requirement to provide a credentialed, monitoring agent deployed on the network device for use in traversing communication paths across VA’s network. Allowing additional agents credentialed access to network devices increases the risk of threats and vulnerabilities on the device and may require re-Accreditation of those infrastructure systems.

Additional market research was conducted in April 2020. VA technical experts posted a Request for Information on NASA SEWP V GWAC to determine if resellers were available. One response was received from a RedSeal reseller. The one response was determined to be capable of meeting VA’s technical requirements. Only RedSeal, or an authorized reseller, have access to RedSeal proprietary codes. RedSeal allows VA the capability to be deployed and integrated with eMASS, the capability to provide network virtualization and mapping and to be deployed without additional constraints and efforts on VA staff.

Based on all of the market research efforts, the Government’s technical experts have determined that only RedSeal products can meet VA’s technical requirements.

The Contract Specialist conducted market research in June 2020 through the use of the Provider Lookup Tool on the NASA SEWP V GWAC web site. The research revealed that there are multiple resellers of brand name RedSeal products including multiple verified Service-Disabled Veteran-Owned Small Businesses (SDVOSB) within Group B(2). Additionally, NASA SEWP V has a dynamic catalog where line items can be added based on customer requests; therefore, as long as the required item or service is within scope of the NASA SEWP V contracts, items and services can be added to the catalog on a daily basis.

Since it has been determined that there are more than two (2) SDVOSBs resellers of RedSeal products who hold current NASA SEWP V contracts, limited competition can be expected among NASA SEWP V GWAC resellers. The solicitation will be issued for consideration of quotes only from SDVOSB GWAC holders in Group B(2) under North American Industry Classification System code 541519.

9. Other Facts: Not applicable

L. Oster 211487

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Steven Oster Date: Steven L. Digitally signed by Steven

Oster 211487 Date: 2020.08.31 16:12:04

IT Specialist, ISO Signature: -04'00'

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among NASA SEWP V GWAC holders. Additionally, NASA SEWP determines that all catalog prices on its GWACs are fair and reasonable. Additional price analysis may be performed in accordance with FAR 15.404-1(b).

Debra G. Clayton Date:

Digitally signed by Debra Clayton Debra Clayton 296083

296083 Date: 2020.08.31 16:25:55 -04'00'

Procuring Contracting Officer Signature:

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Debra G. Clayton Date:

Procuring Contracting Officer Signature:

Digitally signed by Debra Clayton Debra Clayton 296083

Date: 2020.08.31 16:26:26 -04'00'

13. Legal Sufficiency Certification: I have reviewed this justification and find it adequate to support an exception to fair opportunity and deem it legally sufficient.

Ellen P. McArthur Date: xxxxxxxx

Legal Counsel Signature:

Ellen P. Mcarthur 1365283

Digitally signed by Ellen P.

Mcarthur 1365283 Date: 2020.08.31 16:59:19 -04'00'

29608

Approval

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby approve the acquisition of brand name RedSeal engineering support, training, hardware and software licensing, maintenance and installation upgrades for the architecture, and implementation and integration needs for the cloud on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: xxxxxx Signature: xxxxxx

Michele R. Foster Head of the Contracting Activity Technology Acquisition Center Office of Procurement, Acquisition, and Logistics

296083