JA VA-20-00089202 (Palo Alto Networks Fair Exception)_redacted.pdf

Palo Alto Networks Security Equipment Control Number: VA-20-00089202 Services Training

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-wide Acquisition Contract (GWAC) for brand name Palo Alto Networks training and consulting services.

3. Description of Supplies or Services: The Department of Veterans Affairs (VA) Office of Electronic Health Record Modernization (OEHRM) has a requirement for brand name Palo Alto Networks training and consulting services for existing Palo Alto Firewall Networks security equipment and associated hardware. OEHRM is securely connecting VA medical centers and clinics to the Cerner data center where the Electronic Health Record (EHR) solution is being hosted. The hosting environment is jointly managed by the Department of Defense (DoD) and VA. The required training and consulting services shall support Palo Alto Firewall Networks security equipment and associated hardware, software and maintenance during the migration of the Veterans Health Information Systems and Technology Architecture to the new EHR. These services are required to support the migration to the initial operating capability sites during the base year, with services required for continued scheduled migrations throughout the Veterans Integrated Service Networks for the following four years. Palo Alto Networks training and consulting services shall assist VA in testing the data security functions provided by the currently deployed Palo Alto Networks next generation firewalls that connect the VA Medical Centers to the DoD Medical Community of Internet (MedCOI) network and enable access to the to the Cerner electronic medical record. The data security functions include application security filtering, anomaly detection, intrusion prevention, data encryption, and event reporting. Additionally, training and consulting services shall support VA staff in establishing methods and procedures for monitoring firewall operation and understanding and responding to alerts generated by the firewalls. These data security functions are all required as part of the Joint Security Architecture developed with the DoD to connect to MedCOI. The period of performance shall be 12 months from date of award, with four 12-month option periods for continued training and consulting services. No hardware or software is being procured as a result of this action. The total estimated price of the proposed action is

, inclusive of all option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research as described in section 8 of this justification, it was determined that limited competition is available among authorized resellers for the required brand name Palo Alto Networks training and consulting. As the Palo Alto Networks next generation Firewalls are currently implemented in the VA network, and VA requires training and consulting services for testing data security functions provided by those firewalls, only brand name Palo Alto Networks consulting services and training can meet the VA’s requirements. The existing Palo Alto Networks next generation Firewalls and the training and consulting services are proprietary to Palo Alto Networks. Palo Alto Networks restricts the sale of its products and services to authorized resellers.

Therefore, only authorized resellers have access to data and source material required to provide the required training and consulting services to meet VA needs.

Failure to acquire the Palo Alto Networks training and consulting services would result in VA not having the training and consulting services needed to maintain and operate the Joint Security Architecture as required to enable access to the new EHR. In addition, if the Joint Security Architecture is not maintained and operated as required, secure access to Veteran records and data privacy would be compromised.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, it was determined that limited competition is viable among resellers for these specific services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the System for Award Management’s Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: A Request for Information (RFI) was issued on July 17, 2020 on the NASA SEWP V GWAC. The RFI # 161435 closed on July 23, 2020, and contract holders provided quotes:

. contract holders who provided quotes are Service-Disabled Veteran-Owned Small Businesses (SDVOSB). Additional market research was also conducted by the Government technical expert in August 2020 by searching the Internet and reviewing other training and consulting portfolios

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable.

Contracts awarded on NASA SEWP V GWAC have already been determined to be fair and reasonable. As there are multiple resellers on the NASA SEWP V GWAC capable of providing the brand name Palo Alto Networks training and consulting services, price competition is anticipated. Finally, if only one quote is received price analysis shall be conducted by comparing the successful quote to the Independent Government Cost Estimate.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Palo Alto Networks training and consulting services on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.