McAfee JandA_FINAL_Redacted.pdf

Control Number VA-21-0035481

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-priced Delivery Order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract

(GWAC) for brand name McAfee software subscriptions, appliances, and support services.

3. Description of the Supplies or Services: VA, Office of Information and Technology

(OIT), IT Operations and Services , Solution Delivery has a requirement to renew and expand upon existing McAfee software subscriptions currently deployed within the enterprise as part of the Enterprise Endpoint Security Solution (EESS), along with the capability to procure add-on capabilities and support services. Today, McAfee products secure over 625,000 VA desktop, servers, and laptop assets and provide information security capabilities that are critical to maintain and protect VA products, equipment, and services for its employees and Veterans. Various brand name McAfee licenses, subscriptions and support services are required to monitor and protect multiple mission critical platforms including desktop workstations, laptop computers, tablet devices, portable devices, servers, and cloud implementations. Specifically, the base requirement will renew existing McAfee endpoint licensing and support of 595,000 MVISION Protect Plus subscriptions, 26,000 McAfee Cloud workload Security –

Advanced subscriptions, 650 McAfee VirusScan Enterprise for Storage subscriptions, 650 McAfee HIPS for Servers software support, and McAfee’s Premier Success Plan.

Optional line items will make available additional licenses of the aforementioned subscriptions, as well as add-on licenses and appliances for additional capabilities, training, and professional services for architectural support and incident response as may be required during the period of performance. The optional line items for additional licenses of the existing software products will support anticipated growth of the existing product suite over the next five years and is estimated to be 1.4% of the total optional ceiling price. Optional line items for additional add-on capabilities will consist of software not currently implemented but identified as a potential need based on the EESS contract requirements to meet Department of Homeland Security (DHS) mandates under their continuous diagnostics and mitigation (CDM) requirements, National Institute of Standards and Technology (NIST) Special Publication 800-72 and NIST 800-53 Revision 5 forensic requirements, address specific Office of Inspector General (OIG) audit findings relating to the handling and tracking of sensitive data, or necessary to keep up with the ever changing threat landscape facing the information technology (IT) industry. Option line items for add-on capabilities are estimated to be 94.7% of the total optional ceiling price and will include: McAfee’s MVision EDR which are required to meet the NIST requirements outlined in Section 3; McAfee’s Data Loss Preventing (DLP) software, which is required to address OIG audit findings within the

McAfee Software and Support Services Control Number VA-21-0035481

VA; McAfee’s Advanced Threat Detection appliance-based solution required to evaluate malware samples in a safe and isolated test environment; as well as add-on software subscriptions, required to effectively move between the current on-premise deployment and McAfee’s software as a service structure. Optional services will include McAfee sponsored training on administrative management best practices for existing and new endpoint products deployed within VA; professional services consisting of dedicated McAfee technical support subject matter experts to assist VA in analyzing, architecting, implementing, managing, and operating ESS based on the existing or expanded McAfee product suite deployed across the enterprise; incident response and/or data breach services relating to data loss or intrusion activities. Optional line items for these services are estimated to be less than 3.9% of the total optional ceiling price. The

Period of Performance (PoP) for the Base subscription renewals will be 12 months, from May 16, 2021 through May 15, 2022, with four 12-month option periods. The PoP for each optional line item will be up to 12 months, co-termed with the base period annual subscriptions. While VA will continue to conduct market research prior to the exercise of each option period, it is anticipated that the renewal and expansion of the existing McAfee product suite will be required for at least five years to effectively support VA information security capabilities.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), this brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, limited competition is available among resellers of the brand name McAfee software subscriptions, appliances, training and professional support services.

The McAfee product suite was proposed as part of the EESS order awarded via a competitive acquisition under the Transformation Twenty-One Total Technology Next Generation (T4NG) contract in May of 2019. The EESS order established the groundwork for a fully integrated and modular enterprise security solution that would directly support a holistic security posture approach through a single management console, which is essential for VA enterprise security. The existing solution consists of an integrated suite of McAfee’s software that communicates through the McAfee Agent to be ingested by the ePolicy Orchestrator (ePO) console for parsing and management creating a hub and spoke design for their product offerings. Due to its proprietary design, not other brand software is compatible with McAfee’s proprietary source code that makes up the integrated solution. As such, no other brand software can be integrated into the existing environment and communicate through the McAfee Agent and ePO console. The ability to cover VA’s required endpoint security capabilities through a single vendor and management console is unique to the McAfee product suite when compared to other vendor solutions. VA requires the ability to utilize a single agent and management console for endpoint security products once scaled to a full endpoint security suite to maintain and expand upon VA’s existing enterprise security platform. Specifically, VA utilizes the McAfee ePO to collect and communicate with all managed devices or endpoints throughout VA. The endpoints, through the McAfee Agent, report back to the centralized console details about the endpoint itself and the threats which were seen or investigated on the endpoint. This centralized reporting-back process allows for near real-time information to be gathered, discriminated for action, and reported to VA decision makers or stakeholders on how to address these occurrences at a macro organizational level or micro single system level. Other vendor solutions can only provide the required capabilities by utilizing a divested solution approach comprised of multiple management consoles or through the use of multi-vendor solutions, which would result in a non-centralized management approach which would divest the management of the complete solution into multiple consoles or unique architectures which may be aligned with a specific vendor(s). All other potential alternative and/or replacement solutions reviewed would require this multiple layer approach causing complication and high risk of security gaps, and would thus create an environment with application incompatibilities and higher service impacts to VA.

More specifically, if a divested solution was utilized, each vendor would require their own management console, endpoint agent, and supporting architecture to be deployed within the VA to provide software updates, manage client communication, and act on client events. Each new agent loaded on a client due to a multi-vendor solution would require system resources allocated to that software; a fully divested solution would place unneeded strain on endpoints which would potentially impact their ability to provide their day-to-day function. The proposed McAfee solution, by way of comparison, uses a single endpoint agent for their entire suite of products thereby maintaining a smaller resource use footprint on an endpoint, permitting the solution to provide greater overall effectiveness with the least impact on endpoint resources. Many endpoints within VA fall into a low-end category and maintain a one to four core processor with four to eight gigabytes of available memory. Today’s operating systems require at least one processor core and between two to four gigabytes of available memory. The remainder is available for all other applications and processes on the system. As the available resources are divided amongst those applications, the performance of the system is exponentially impacted. This results in slower system response or system crashes, which has the potential to negatively impact productivity of users of endpoint resources in the field. The only realistic option to overcome this result is to expand the resources available on systems or require a full replacement of systems that fall below an identified resource threshold. VA actively has thousands of systems which operate at this lower specific configuration; replacement of these low-end systems would be necessary should a vendor solution other than the McAfee solution proposed be utilized, given the decentralized and fragmented approach that would ensue from the use of an alternative, multi-vendor based solution to meet this need. This replacement would impact systems of all types ranging from VA’s virtual infrastructure, kiosk systems providing veteran services within the medical centers, medication dispensing programmable logic controllers (PLCs), VA medical center staff terminals, and end users who’s PCs throughout the VA fall below this threshold.

A multi-vendor solution also brings another challenge in the form of individual management consoles per solution. Configuration issues and a disjointed product scope will result through attempts to utilize a divested overall solution and recreate the coverage provided by the already centralized McAfee product suite. Decentralized configuration management, in addition to a disjointed product scope, will negatively impact the ability for different products to talk to one another, creating silos for each product grouping. Because of this disjoined communication, differing components / solutions will require independent action in multiple consoles to achieve the same result that would be obtained within a unified console such as that provided by the proposed McAfee solution. Such a disjointed, decentralized environment poses the risk of creating gaps in critical coverage, increasing the chance of multi-vendor inoperability due to configurations not being fully visible to the other vendors or administrators. This negative effect is further impacted through the configuration or policies or settings applied for each product, which would have to be replicated between multiple consoles.

As each console would then become, in effect, a proprietary solution, where the ability to revise settings or configurations between product groups would be limited, and manual replication of changes would be required. This undesirable result will introduce a high risk for configurations to be missed or not properly implemented, which would leave systems open for attack vectors not covered in the configuration. The need to engage in manual effort to ensure proper configuration management at the console level, if not lower, exponentially increases the chance of this occurring across the greater number of consoles that would be required to manage the total solution.

Further negative impacts will also result through use of a multi-vendor solution due to overlap in specific areas based on each product’s specific solution capabilities.

Overlaps between multi-vendor products are likely to result in system errors and ultimately system crashes/ failure to provide critical protective measures based on two applications attempting to take action against the same file or in a similar way within the endpoint. Significant tuning would be required to facilitate appropriate roles by each application or vendor product, requiring the expenditure of hundreds of VA labor hours to prevent such conflict events arising due to the concurrent use of multi-vendor solutions. VA has identified through use cases that even with such tuning, even in passive mode of other products through yielding a specific function over to a specific provider or product, the other observers still maintain some level of access to the file due process hooking and inspection actions, which have resulted in the errors described.

The use of a single management console, available only through the proposed McAfee product suite, will allow settings between products to be easily cross referenced, and base required coverages can be in place at the coverage level or point product, allowing for a more centralized, holistic security posture approach to be used enterprise-wide.

The use of the McAfee solution also allows for an optimized use of each product without providing overlap, thus reducing the chances for inoperability that may result from conflicts between multi-vendor solutions. Due to the cohesiveness of the single vendor solution, interoperability is reduced providing clear roles and duties to be distributed amongst the product offerings by the single vendor and thus removes the impact that would otherwise be introduced in a multivendor approach.

As part of the base requirement for the renewal of VA’s existing McAfee licenses, VA’s McAfee MVISION software package subscription will include McAfee Threat Intelligence

Exchange (TIE) and McAfee Data Exchange Layer (DXL). TIE is a key component for application control due to its ability to whitelist VA developed applications which are unique to VA. Since the reputation source provided by TIE is customizable, in-house applications can be omitted from generating false positives which would otherwise prevent the execution of those applications when application control is enabled.

McAfee DXL allows for feeds to be consumed from other security vendors and solutions implemented within VA and populated within McAfee’s centralized management console, ePO, for actionable automation. This enhances the ability of ePO to automatically respond to threats within the environment based on information from sources beyond the McAfee product suite. This information could then be used to trigger specific McAfee endpoint product policy assignments which would in turn adjust their responses on the endpoint based on the newly identified threat. As a result of

McAfee’s proprietary design, and its centralized reporting-back process, these critical capabilities and the associated level of automation can only be achieved by leveraging brand name McAfee software components within VA’s existing implementation. Based on extensive market research efforts, no other vendor solution offers these combined capabilities necessary for VA to meet the DHS CDM requirements for application control and whitelisting while meeting all other endpoint security needs within one application platform and centralized management console. While other vendors provide application control functionality, this can only be achieved through a divested management console that operates separate and independent from VA’s existing ePO.

Furthermore, only brand name McAfee add-on software can be integrated into the existing product line to provide the required expansion capabilities within the existing ePO console, due to its proprietary design. Expanding upon VA’s existing McAfee implementation through brand name McAfee add-on subscriptions will be simplistic and seamless, given the already existing and established communication cycles and pathways which have been defined through utilization of the McAfee Agent and shared with other McAfee endpoint products. Unique VA gateway allowances (i.e., pathways and communication lines) have been established within the existing McAfee product suite as part of the extensive and ongoing EESS configuration and implementation effort to provide for a cloud hosted presence for the management console and front end client services, while also maintaining a local enterprise presence for software distribution. Each new McAfee product deployed under the McAfee suite can therefore leverage the same McAfee Agent to report its status and events back to the ePO console providing again the micro or macro level detail as it applies to those entries, given the VA’s previous, extensive configuration efforts in utilizing the McAfee product solution. This inherent leveraging/ implementation capability has proven to be vital to the success of the McAfee product within the VA as it prevents the need for additional agents for each component on the endpoints. For example, the McAfee’s DLP software add-on is the only DLP software that is interoperable with VA’s existing McAfee implementation and centralized management console. Therefore, McAfee DLP is the only brand DLP software that is capable of being seamlessly integrated into the existing environment to enable communication with all managed devices or endpoints throughout VA to accurately evaluate and classify sensitive data within those endpoints and report that data back to the ePO server for immediate action. This interoperability and associated information sharing across the McAfee product suite through the ePO console is essential to effectively monitor all VA endpoints.

VA’s currently deployed McAfee product suite represents eighteen months of licensing, configuration and implementation work undertaken for the software to operate in VA’s production environment and across the enterprise. These efforts have cost over $35M to date including $12M in licensing and $23M in configuration and implementation services. This involved establishing the solution within both VA’s on-premise facilities and the VA Enterprise Cloud, migrating all existing settings from the previous solution into the current solution, obtaining a VA Authority to Operate (ATO) for the new solution, and establishing all necessary communication channels and VA specific policies and settings for the solution to function within VA. The existing suite of McAfee software and support that make up, in part, VA’s EESS and provides a wide array of information security capabilities that are critical to protect VA on-premise and cloud-based systems and services at the endpoint or host level from malicious software, malware, and intrusions both from within and external to VA. As a result of the 2019 EESS contract and extensive configuration efforts, McAfee is now deployed as part of the VA baseline on every VA system. VA’s existing McAfee software subscriptions will expire in mid- May 2021, and failure to renew these licenses will bring VA’s critical automated information security monitoring capabilities to an immediate halt, leaving VA susceptible and vulnerable to both internal and external threats which could potentially compromise

VA’s sensitive data, reputation, and its customers private information.

Aside from the inability of any other brand solution to meet VA’s requirement of a single management console as discussed above, replacing the existing McAfee product suite with a multi-vendor solution would require at least 18 months or longer to implement, and would lead to duplicated costs in upwards of $80M that would not be recovered or justified through competition as the existing functionality would have to be reconfigured through a divested solution all while still maintaining the critical functionality provided through VA’s existing EESS until the new product suite is fully operational. This estimate is based on historical data for licensing, configuration, and sustainment costs of EESS and similar security products and VA enterprise solutions. Costs would include approximately $20M to maintain the existing solution through the configuration and cutover period of a replacement solution, and $60M to license replacement software products, establish the secondary infrastructure required to host a replacement solution, and configure the new solution to replicate existing functionality, along with additional operational and management costs associated with the transition from the McAfee solution to a new solution. Such additional operational and management activities would include re-training VA administrators on utilizing the new solution, updating Standard Operating Procedures, obtaining a new ATO, and extensive coordination efforts with multiple VA groups including Active Directory, messaging, Enterprise

Service Desk teams, VA Cybersecurity Operations Center, among others to ensure current operation capabilities could be re-established for the new solution. This would also require extensive evaluations across all VA facilities and environments to validate if a new solution would be applicable while not impacting any of those services from their normal operations. Any such replacement effort would lead to extensive delivery delays of ongoing and planned functionality releases that are necessary to enhance VA’s existing product suite to provide additional critical capabilities that will enable VA to more proactively monitor and protect on-premise and cloud-based systems and services and meet all federal mandates as described in Section 3.

As a result, only brand name McAfee products and services can meet VA’s requirements to renew existing software licenses, and expand the existing environment for increased functionality through a fully integrated suite of security products that are operated and managed through one centralized management console. Failure to renew the existing licenses will bring VA’s automated information security monitoring capabilities to an immediate halt, and replacing the existing platform would result in extensive delivery delays of critical information security capabilities and significant duplicative costs that would not be recouped through competition. Finally, expanding upon the existing platform to provide additional capabilities through alternate brand products would result in significant interoperability constraints and disparate management consoles that would not only increase the risk of security vulnerabilities, but would also hamper VA’s ability to establish a fully integrated and modular enterprise security solution that directly supports a holistic security posture approach across the enterprise.

As part of the base requirement for the renewal of VA’s existing McAfee software subscriptions, VA also requires McAfee’s Premier Success Plan which provides maintenance support for all licensed/deployed McAfee products. Access to McAfee’s proprietary source code is required to provide this maintenance support, which will include upgrades and bug fixes as well as technical support through McAfee product engineers. No other source is capable of providing the required software maintenance and support, as only McAfee has access to the proprietary source code necessary to provide the required software updates and technical support. The inability for other sources to gain access to McAfee’s proprietary source code makes it impossible for other potential sources without such access to modify McAfee proprietary software code as necessary to provide the required updates. Access to this code is also required to ensure the services provided to the software are properly configured.

In addition to optional line items for add-on software and appliances, optional line items are required for training and professional support services as discussed in Section 3.

Specialized training on McAfee products in use, and as new products are deployed, will be required throughout the period of performance. McAfee does not authorize third-party training for any of its products. Training on McAfee products is available only through McAfee to ensure the training meets the needs and criteria required for in-depth management or use of their products.

McAfee Professional Services are therefore required to optimize implementation, configuration and use of the McAfee product suite, as well as to provide incident response capabilities to minimize impacts associated with security breaches or security incidents. Access to McAfee proprietary data is both vital and necessary to ensure operational integrity of the McAfee products provided under this proposed effort. Only

McAfee resources are certified in configuring McAfee products, and retain a direct line to engineering and the McAfee Enterprise Architecture teams who can access the McAfee software characteristics to ensure proper operation, configuration, and integration of McAfee products already licensed and operating, or those that will be added to the existing environment though optional add-on software and appliances. On average, code modifications or customized fixes to the McAfee software are required quarterly, based on VA-specific implementation efforts and environmental variables present in VA’s continually changing infrastructure. Only McAfee resources can execute these required code modifications or customized fixes, due to proprietary constraints as noted above. Further, access to McAfee’s proprietary software characteristics is often required during VA deployment efforts to troubleshoot unique software issues in a timely manner. Obtaining this support through a third-party provider, without access to McAfee’s proprietary software characteristics or a direct line to McAfee engineering resources would result in either an inability to troubleshoot software issues or significant delays (and potentially compromising) support of critical

McAfee deployments.

Finally, in the event of a data breach or security incident, direct access to VA’s McAfee endpoint suite is critical to determine the full scope of the breach or incident. Only

McAfee’s Incident Response team can access tools already deployed in the environment to be refocused in disaster scenarios to more quickly identify, mitigate, and respond to the specific incident ensuring minimal impact to VA’s customer base and its services. Without this capability, any third party incident response team will require additional components outside of the standard enterprise deployment to be deployed into the existing environment, requiring additional time and effort and ultimately delaying the critical information gathering process necessary to properly address the incident.

Due to the nature of the professional support services which will be tightly coupled with the software subscriptions and premium success plan maintenance package, the software and services must be procured under the same effort through the same reseller in order to ensure full visibility of VA support issues and nuances of the VA environment which is critical for full solution integration. Obtaining the required software and support services through multiple resellers under separate efforts would hamper VA’s ability to effectively strategize and coordinate implementation efforts and drive roadmap discussions and decisions based on VA usage of products, thereby introducing undue administrative burden and delivery delays.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in the market research section of this document. This effort did not yield any additional solutions that can meet the Government’s requirements. It was determined that limited competition is available among resellers for the required brand name McAfee software, appliances and support services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contracting Opportunities Page at beta.sam.gov website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, OIT will continue to monitor market trends, new/emerging products, looking for compatible and more advanced technologies to meet VA information security needs.

8. Market Research: The Government’s technical experts have conducted continual and ongoing market research on alternative products in the marketplace starting in 2019 as part of the competitive T4NG acquisition and up until February of 2021 to assess the viability of alternative products to meet the full scope of VA’s endpoint security requirements. Market research efforts consisted of thorough reviews of technical specification documents and white papers, product demos, and interactions with other government agencies. Alternative brand products reviewed included Symantec, Microsoft, CrowdStrike, and Trend Micro. While these products were found capable of meeting a subset of VA’s requirements, the technical experts confirmed that none of these products can cover all VA’s required endpoint security capabilities through a single vendor and management console, and none are interoperable with the existing McAfee product suite and management console due to proprietary constraints. Finally, no other vendor can access McAfee’s proprietary tools and software characteristics in order to provide the required training and support services.

In addition, multiple Requests for Information were issued on NASA SEWP V between

January and March 2021 to obtain budgetary pricing for the required McAfee products or services. Responses were received from multiple NASA SEWP contract holders that are capable of reselling the required McAfee products and services. One of the RFI responses provided pricing for an alternate brand product, Trend Micro. A review of the

Trend Micro response by VA’s technical experts confirmed that it could not cover all VA’s required endpoint security capabilities through a single vendor and management console. Specifically, the Trend Micro solution utilizes multiple agents and consoles to manage on-premise devices and cloud hosted devices; and multiple consoles to manage endpoint encryption capabilities and its anti-virus functionality. Therefore, Trend Micro does not meet the Government’s technical requirements. Further market research was conducted in April 2021 by utilizing the NASA SEWP Provider Lookup which revealed multiple NASA SEWP GWAC holders that are resellers of brand name

McAfee products including multiple small business and SDVOSB contract holders.

However, the requirements for this effort include brand name McAfee professional services that must be performed by McAfee personnel due to proprietary constraints as detailed in Section 5. As such, no small business or SDVOSB concern would be able to comply with the limitations on subcontracting requirements if the solicitation were to be issued as a small business or SDVOSB set-aside. As such, and considering the required brand name McAfee products and services are available from multiple resellers on NASA SEWP V such that adequate competition exists on this vehicle, the solicitation will be issued for competition among all NASA SEWP V contract holders in Groups B, C and D under NAICS code 541519, and will not be set aside.

9. Other Facts: None