Justification and Approval_SafeNet FINAL SIGNED Redacted.pdf

VA-20-00058341

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: This proposed action is for issuance of a firm-fixed price delivery order under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-wide Acquisition Contract (GWAC) for the procurement of brand name SafeNet Assured Technologies (AT) hardware, software licenses and maintenance.

3. Description of the Supplies or Services: VA Office of Information and Technology (OIT), Information Technology Operations and Services (ITOPS) requires renewal and procurement of additional brand name SafeNet hardware, software licenses and maintenance in support of the Enterprise Electronic Key Management System (EEKMS) project. These products include SafeNet AT KeySecure Encryption Key Hardware Management Platforms, KeySecure Connector Licenses, Luna SA Hardware Security Modules (HSMs), reinstatement fees and associated maintenance. The proposed renewals for maintenance and licenses include 780 each of HSMs for SafeNet ProtectConnect Server and Standard Key Management Interoperability Protocol (KMIP) Connector, Standard Extended Maintenance for 8 SafeNet KeySecure G460s, and 6 HSMs for SafeNet KMIP Connector Standard Extended Maintenance. Also included in the renewal, VA intends to reinstate 50 licenses for the SafeNet AT KeySecure Encryption Key Hardware Management Platforms that had previously lapsed, and co-term said licenses with the additional 131 licenses that are due to renew during the base period.

The EEKMS project manages encryption keys and protects Veterans’ data that conforms to VA policies, Federal regulations, and standards. EEKMS consists of brand name SafeNet hardware, Structured Query Language (SQL) databases and applications hosted within VA data centers. Currently, EEKMS is set to migrate from “on-premise” hosting to the VA Enterprise Cloud (VAEC), specifically the Amazon Web Services (AWS) GovCloud. VA OIT ITOPS requires the purchase SafeNet KeySecure and Luna SA hardware, in addition to SafeNet licenses that work within AWS to expand the existing key management system capabilities to accomplish this migration.

Specifically, this proposed augmentation shall consist of procurement of 4 new SafeNet KeySecure G350 devices for AWS with associated maintenance, and 4 new Luna SA 1700 Remote PED devices with associated maintenance, which are required for augmentation. SafeNet hardware and software maintenance support consists of software updates, patches and pushes, and commercial break fix maintenance/warranty for hardware components. This encryption equipment is required to support clinicians across the VA Enterprise. All hardware and software shall be delivered 30-45 days after date of award. Equipment will be implemented upon delivery by VA staff within 30 days of receipt of the items. The total Period of Performance includes a base period of 15-months (includes reinstatement fee and co-terming of maintenance), with two subsequent 12-months option periods for maintenance and renewal of licenses, if exercised. The total estimated value of the proposed action is inclusive of all options for continued support.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, it was determined that only the brand name solution set of SafeNet hardware, software and maintenance could meet the Government’s requirement. As stated above, this effort will renew existing maintenance and licenses, as well as expand the existing key management system in production, which supports VA EEKMS. The current SafeNet solution requires augmentation that ensures compatibility and interoperability with the deployed SafeNet equipment/licenses. This SafeNet solution consists of proprietary hardware and software that allows for key communication within EEKMS. Specifically, the SafeNet solution communicates and operates upon proprietary code in order to allow VA to encrypt and decrypt VA sensitive data such as Personally Identifiable Information (PII) and Personal Health Information (PHI) veteran centric data. Only through use of this proprietary code would VA be able to decrypt data that has already been encrypted.

As the EEKMS solution migrates to the VAEC, additional hardware and software licenses, with maintenance support is required to ensure successful cutover. The security appliances must network/integrate to achieve full interoperability with the existing VA network infrastructure. Utilizing any other manufacturer’s hardware and software would impact VA’s ability to implement and maintain a workable baseline which presents encryption security and business continuity risk for delivering health and benefits services. Therefore, for security and system stability, only the proposed brand SafeNet Hardware, Software and maintenance can satisfy the Government requirement for full interoperability with the existing solution and communicate through the proprietary code. While it is impossible to include security components other than SafeNet, the only possibility would be to replace the entirety of the EEKMS system. This would leave the Agency in an exceedingly vulnerable state for a period of time during that transition. In addition to the cost to procure alternative licenses, hardware, and maintenance, VA estimates that the time to deploy an alternative EEKMS solution would take a minimum of two years and cost approximately $3.5M, based on historical information. For instance, the Custom libraries, which provide encryption and communication capabilities between Intersystems Cache and the SafeNet software, would require approximately six to nine months to re-develop the communication protocols. Additional VA system work is not included in this estimate, nor would the procurement acquisition lead time necessary.

Additionally, VA requires renewal of maintenance of the SafeNet solution. The proposed maintenance must be provided by SafeNet or its authorized resellers.

Specifically, due to the proprietary nature of the software code and hardware appliances, only maintenance services provided by SafeNet or its agent will have the necessary access to manipulate the code, write seamless software patches, or provide replacement of proprietary components. Software maintenance provided by any other source significantly increases the risk that these patches would render the entire EEKMS solution inoperable and open VA up to security vulnerabilities. Maintenance of the existing software licenses and coverage of the hardware ensures that the EEKMS solutions continues to operate in the event of outages/disasters. For instance, without renewal of the maintenance VA would lose its ability to decrypt/encrypt data. This functionality is critical in the event of Wide Area Network (WAN) outage. Data is encrypted as a backup at the 130 VA Medical Centers (VAMCs), and without this ability to decrypt that data, VA operations would cease. Specifically, Veterans Health Information Systems and Technology Architecture (VistA) Read Only, the application to be utilized during a WAN outage, would not be able to be utilized. The required maintenance and licenses which support EEKMS must be renewed as proposed in order to ensure continuous operation and contingency operations for the Agency.

During this time, VA would lose its critical ability to encrypt/decrypt the data.

Therefore, failure to renew and augment the EEKMS solution as proposed would directly affect the VA’s ability to complete its mission, and secure critical Veteran-centric data necessary to provide care and benefits.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name SafeNet AT hardware, software licenses and maintenance. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website (beta.SAM.gov) and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, the Government will continue to investigate alternatives to SafeNetAT products that may be compatible with the current infrastructure.

8. Market Research: VA Government technical experts conducted market research via web searches and review of other manufacturers websites and databases in April 2020 to ascertain if similar hardware products software licenses and maintenance could meet VA’s functionality requirements. Specifically, VA reviewed offerings from AWS Key Management System (KMS), Microsoft Azure KMS, Vormetric, Nokia USA Inc., Cloud-

Juncxion, Inc. and Immix-Technology products. However, none of these sources can interoperate with the existing EEKMS solution, which is based on SafeNet hardware and software as noted in section 5 of this Justification. Based on this market research, it is determined that only brand name SafeNet products, software and maintenance can be utilized to support EEKMS.

In May 2020 additional market research was conducted by utilizing the NASA SEWP V GWAC Provider Lookup Tool which confirmed that there are several resellers of the required hardware, software licenses, and maintenance support. As a result of the above market research, it is determined that there is a reasonable expectation that limited competition exists on the NASA SEWP V GWAC for the brand name SafeNet includes SafeNet AT KeySecure Encryption Key Hardware Management Platforms, KeySecure Connector Licenses, Luna SA HSMs and associated maintenance.

9. Other Facts: None.