Justification and Approval - REDACTED.pdf

Centrify Active Directory Software Maintenance CONTROL NUMBER VA-25-00042029

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for the firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC), for brand name Centrify software maintenance and support.

3. Description of Supplies or Services: The VA Office of Information and Technology (OIT), Office of Information Security requires ongoing maintenance and related support for 12,145 brand-name Centrify perpetual software licenses. This software is used to manage access for VA users and VA systems running Linux/Unix based servers within the Active Directory (AD) environment. The AD simplifies user management, controls access to data and enforces company security policies by centralizing authentication and authorization to network resources. This simplification of user management also contributes to one of OITs stated goals to consolidate 34 different ADs into one single domain (va.gov). Centrify services manage user credentials and access to elevated privileges for VA network resources, while AD administrators manage the user access and elevated privileges for the VA Linux and Unix systems. The software also secures privileged access, particularly for administrative accounts and granular controls for sensitive systems within VA organizations. Centrify is an Active Directory ‘snap-in’ leveraging two factor authentication, providing a better security profile and aligning to VA requirements and security standards. Centrify seamlessly integrates their proprietary Zero-Trust technology into the Centrify Access Manager Suite using secure hooks to 2fa on the VA network, with no further development or provisioning efforts, making it ideal for rapid and reliable deployment. Centrify enables the VA to ensure the uninterrupted delivery of benefits to our Nation's Veterans and their beneficiaries. It also supports the mission-critical functions of providing healthcare to Veterans, beneficiaries, and disaster victims, ensuring the provision of well-being benefits to Veterans and eligible beneficiaries, and managing VA Home Loans, Compensation, and Pension payment services without disruption. Maintenance and support includes downloads, upgrades, troubleshooting, and 24/7, 365 days per year technical support for the currently installed Centrify software, ensuring these systems remain operational.

The Period of Performance shall be a base period from July 16, 2025 through July 15, 2026, and two (2) 12-month option periods. The total estimated price of the proposed action is $3,065,582.50, inclusive of options.

4. Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand-name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research as described in Section 8 of this document, it has been determined that limited competition is available among resellers of the required Centrify brand-name software maintenance support. The existing Centrify perpetual software licenses provide the underlying core functionality necessary for AD administrators to manage the VA systems running Linux/Unix systems within AD. Specifically, the existing solution includes managed agent software which is installed on each of the VA systems running Linux/Unix and a proprietary management interface to AD. The agent software installed on each server and workstation object is owned by the VA in perpetuity. This is a critical VA requirement, and no alternate software would provide the same functionality as Centrify including synchronization for integration into Active Directory. The agent software provides communications with AD for user authentication and authorization. The VA requires brand-name Centrify maintenance to work with the existing VA owned brand-name Centrify perpetual software licenses. Use of any other brand software would result in critical interoperability and compatibility issues with the current infrastructure due to the proprietary relationship between the management interface and the agent software. Existing Centrify brand-name software requires upgrades over time as well as maintenance support. Centrify has proprietary rights to the software and associated maintenance services. Any source that provided these services must have access to Centrify proprietary code. Access to this code is required to ensure all services provided are properly configured. Therefore, the required maintenance services must be compatible with the existing software. Only authorized Centrify resellers have the rights to perform these maintenance services. Only Centrify brand-name software licenses and maintenance can meet all of VA’s requirements, specifically compatibility and interoperability with VA’s existing AD infrastructure integrated with critical business systems running Linux/Unix operating systems. Centrify has proprietary rights to the software licenses currently being used by VA throughout the virtual infrastructure. Given that Centrify has proprietary rights, there are no other vendors that can provide the maintenance services without voiding the licenses currently in use. Due to Centrify copyrights, proprietary database structures, and proprietary software application programming interfaces, no other source can provide the maintenance support required for maintaining these high availability information systems. Without the Centrify software, the VA cannot integrate Linux/Unix systems into the Active Directory. This would result in privileged network accounts being unable to access servers, requiring managed passwords to be set locally on over 12,000 servers. This would lead to security issues including but not limited to inconsistent access control, risk of excessive user privilege, and lack of visibility into who has accessed and has access to the system. Centrify 24/7 application accessibility is key to several critical business applications, including Claims Processing & Eligibility, Community Care Referral and Authorization, and most importantly the Veterans Health Information Systems and Technology Architecture (VISTA) system. The VISTA system maintains the clinical, administrative and financial operations of the Veterans Health Administration, consisting of over 180 clinical, financial, and administrative applications. These applications are utilized by a large number of medical, benefits and healthcare personnel daily, from VA doctors to administrative staff. Without Centrify, access verification to these systems would not be possible, ultimately resulting in the inability to provide certain medical services and records to our nations’ veterans.

Use of any other brand-name item would require a complete replacement of the existing Centrify software licenses and management interface resulting in estimated delays of approximately 18 months and duplicative costs of a minimum of $4.7M. The estimated duplicative costs and timeframe is based on previous acquisition history for the current licensing implementation, and would not be recovered through competition. Additionally, any alternative software would have to be stood up in parallel to the existing Centrify infrastructure further increasing duplication of costs.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, it was determined that limited competition is available among authorized resellers for brand-name Centrify software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), a redacted version of this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, FAR 16.505(b)(2)(ii)(D), and FAR 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government technical experts conducted web-based market research in January 2025 by reviewing similar software and maintenance products and services from alternative vendors. Specifically, the Government technical experts reviewed alternative software from Ping Identity Solutions and Red Hat Identity Management. Ping Identity focuses more broadly on overall user access control and single sign-on across various applications, but does not secure privileged access, particularly for administrative accounts or granular controls for sensitive systems within an organization. Red Hat Identity Manager requires the creation of additional AD domains to effectively manage access permissions, contradicting the OIT’s consolidation initiative. No source other than Centrify’s authorized resellers can access the proprietary source code to provide the required maintenance. Only Centrify has proprietary rights to the software and associated maintenance. After review, the Government technical experts determined that no other product can meet all of VA’s functional requirements, including synchronization for integration into Active Directory.

Additionally, no other products or services would be compatible or interoperable with VA’s existing application management consisting of Centrify software. Further, due to proprietary constraints, the use of any alternative product would require a complete replacement of the existing Centrify infrastructure and extensive duplication of effort by the VA Platforms and Operating System teams to deploy to be stood up in parallel to the existing Centrify infrastructure. As such, no alternative product can avoid the duplicative time and effort as detailed in Section 5 of this justification.

Further market research was conducted by the Contract Specialist in January 2025 utilizing the Provider Look Up Tool on the NASA SEWP V GWAC website, which identified multiple Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) Reseller GWAC holders that provide brand-name Centrify products. Therefore, limited competition is expected among SDVOSB’s for this proposed action.

9. Other Facts: None

10. Technical/Requirements Certification I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Tracy S. Batey Date Associate Director – VA OIT

11. Fair and Reasonable Cost Determination I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among multiple value added resellers of the required brand-name Centrify software maintenance support. Further price analysis of quotes received will be conducted to determine fair and reasonable price. Finally, pricing of products awarded under NASA SEWP V GWAC have already been determined to be fair and reasonable.

Stefanie Applegate Date Contracting Officer

12. Contracting Officer Certification/Approval I certify that this justification is accurate and complete to the best of my knowledge and belief.

Stefanie Applegate Date Contracting Officer

Approval

In my role as the procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Centrify software maintenance and support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Jason Bullen Date:

Advocate for Competition Technology Acquisition Center Office of Procurement, Acquisition, and Logistics Department of Veterans Affairs