JA_Tenable_FINAL_Redacted.pdf

Tenable Security Center Maintenance CONTROL NUMBER VA-25-00014763

JUSTIFICATIONFOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed price Delivery Order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for a renewal of brand name Tenable Network Security Center Software Maintenance and Support for the existing VA owned Tenable Network Security Center (Tenable.sc) perpetual software licenses.

3. Description of the Supplies or Services:

The VA Office of Information Security (OIS) has a requirement to renew software maintenance and support for existing brand name Tenable Security Center software licenses from Tenable Network Security, Inc, 7063 Columbia Gateway Drive, Suite 100, Columbia, MD 21046 for applications located at various VA datacenters. Specifically, this maintenance renewal supports the existing brand name perpetual Tenable Security Center (Tenable.sc) licenses covering an Enterprise License of 1.8M Internet Protocol (IP) addresses, up to 15 console installations, maintenance renewal for a Tenable.sc Director License of 1.8M IPs, maintenance renewal for a stand-alone Unlimited Hosts Tenable.sc console, and lastly renewal of a subscription of 300,000 Nessus Agents. VA requires a solution that would also allow for continued interoperability with the existing scanning infrastructure with no interruption, or delay, of mission.

Specifically, the maintenance and support of this application is required to support network vulnerability security and compliance scanning for the VA Cybersecurity Operations Center (CSOC) Vulnerability Scanning Services (VSS). Tenable.sc which are already in production, perform discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of VA’s enterprise network environment and provide the data to help in assessing the agency’s Information Technology (IT) security state. The existing licenses provide authoritative scanning services by the CSOC to all of VA and allow the CSOC to conduct the monthly enterprise vulnerability scan (Enterprise Predictive Scan), Payment Card Industry scans, external vulnerability scans, scans that assist in granting IT systems Authority to Operate, scans that provide Security Control Assessments, scans that are requested by VA Office of Inspector General and numerous other internal VA offices. The licenses also support enterprise scans required to assess the network for emergent or imminent threats, which scans are often required by various requesting agencies (e.g. the Department of Homeland Security, the Government Accounting Office, the Internal Revenue Service, etc.). Ultimately, the existing Tenable licenses allow VA CSOC VSS to effectively carry out its network vulnerability scanning.

As part of this requirement, VA requires annual renewal of maintenance and support for the software licenses in order to keep the software patched, fully functional and operational. The maintenance and support shall be comprised of technical support provided for troubleshooting vulnerability, reporting of issues, informational type questions during their established hours (Monday through Friday 6:00 AM to 9:00 PM Eastern Standard Time). The period of performance shall be from July 1, 2025 – June 30, 2026. The total estimated value of this proposed action for FY2025 is

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is available for the brand name Tenable.sc maintenance and support among authorized resellers. The Tenable.sc perpetual software licenses owned and utilized by VA are proprietary to Tenable. Due to the proprietary code no other IT products will function within our existing infrastructure and also would not be able to provide the maintenance to patch or update Tenable’s proprietary software. Specifically, another company could not provide the software patches and maintenance that the current VA enterprise’s proprietary scanning software solution would require. Tenable owns the intellectual property rights to the Security Center software. Only Tenable or its authorized resellers have the required access to the source code. Without legal access to the source code, no other provider can troubleshoot problems with the software or develop software bugfixes. Without the required software maintenance and support the software performance would degrade. Additionally, VA would not receive critical security and reliability patches to the software. Legal access to the source code is necessary for the existing VA infrastructure and configuration to run properly. Only Tenable or its authorized resellers can meet VA’s interoperability requirements. Due to these proprietary constraints, the use of any alternative software would require the complete replacement of the existing brand name Tenable infrastructure. Specifically, this would include replacement of 530 servers, 9 management consoles and over 1.8 million software licenses, and 300,000 agents. Based on previous acquisition history, VA estimates this replacement effort would result in a minimum of approximately $9M in duplicative costs required to stand up any alternative Enterprise Vulnerability Scanning System. These estimated duplicative costs would not be recovered through competition.

It is also estimated that this effort would take up to 18 months to accomplish the initial deployment phase during which VA would be either without critical vulnerability information on its enterprise network and IT systems needed to maintain security for VA’s veterans’ data, or the replacement deployment would have to coincide with a current renewal of Tenable to maintain the required vulnerability data while the new system was deployed.

Without renewal of these licenses, the CSOC would not be able to complete the above missions to support network vulnerability security and compliance scanning for the VA

CSOC VSS and VA OIT management would be missing vital enterprise information needed for its risk awareness, for its operational prioritization of resources, and would not be able to respond to required federal actions and reports.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. Currently no vendor, other than Tenable, or an authorized Tenable reseller can provide the required software maintenance and support to Tenable’s proprietary software. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that limited competition is anticipated among resellers of the Tenable brand name software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate and applicable NASA SEWP V GWAC holders along with the Request for Quotation in order to fully notify all interested parties on the NASA SEWP V GWAC. Furthermore, in accordance with FAR 5.301, 16.505(b)(2(ii)(D), and 16.505(a)(4)(ii), notice of award for this action will be synopsized at award on the Contract Opportunities website and the justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be fully competed.

8. Market Research: Tenable software maintenance and support is a commercially available off the shelf maintenance package currently in use in VA. The Government’s technical experts conducted web-based market research in November 2024 by researching other similar solutions from alternative vendors, including those from Rapid7, Qualys and Quay. After review, it was determined that these alternative software and maintenance vendors cannot meet VA’s requirements of a solution that is interoperable with VAs existing infrastructure, or avoid the duplication of time and cost as outlined in Section 5 of this justification. Additionally, based on the market research conducted by the Government’s technical experts, it has been determined due to the proprietary source code that no other software maintenance and support providers can meet the Government’s requirements and be compatible with VA’s existing Tenable Security Center software to perform the needed maintenance and support services.

Only Tenable or its resellers have access to the source code and can provide the necessary support.

Additional market research was conducted in November 2024 by utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name Tenable.sc maintenance and support is available from NASA SEWP V GWAC holders. VA determined that there are Service-Disabled Veteran-Owned Business (SDVOSB) contract holders that are authorized resellers. As a result, there is a reasonable expectation that limited competition exists on the NASA SEWP V GWAC for the brand name Tenable.sc software maintenance and support.

Lastly, a RFI was posted to NASA SEWP in April 2025 that resulted in five (5) businesses responding to the RFI, all five were Service-Disabled Veteran- Owned Small Business’ (SDVOSB’s).

9. Other Facts: N/A

Technical/Requirements Certification I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Fair and Reasonable Cost Determination I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on) historical pricing of previous orders, anticipated competition and discounts among NASA SEWP V GWAC holders. Additionally, NASA SEWP V determined that the catalog prices on it GWACs are fair and reasonable.

Finally, the Contracting Officer shall further determine fair and reasonable pricing based upon comparing contractor quotes to the Government’s Independent Government Cost Estimate

Contracting Officer Certification/Approval

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Tenable Software Maintenance on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.