NNG15SD37B 36C10B21F0202_1.docx

Netskope Application Programming Interface (API) Subscription Licenses

VA-21-00045273

Netskope Application Programming Interface (API) Subscription Licenses

VA-21-00045273

GENERAL INFORMATION

BASE NOTICE TYPE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

AWARD INFORMATION

LINE ITEM NUMBER

AWARDEE ADDRESS LINE 1*

AWARDEE ADDRESS LINE 2*

AWARDEE ADDRESS LINE 4*

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

Award Notice Award Notice

DESCRIPTION

*= Required Field Award Notice Award Notice

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurements (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name Netskope Application Programming Interface (API) subscription licenses for Microsoft Teams, ServiceNow, Slack, Box, GitHub, and Google Drive.

3. Description of the Supplies or Services: VA, Office of Information and Technology (OI&T), Development, Security, and Operations (DevSecOps) Infrastructure Operations (IO), Enterprise Cloud Solutions Office (ECSO) has a requirement for Netskope API subscription licenses to expand functionality for its existing Netskope Cloud Access Security Broker (CASB) deployment. The licenses are required for existing Netskope infrastructure solutions in order to provide security and Data Loss Prevention (DLP) in support of the following mission critical systems in use at VA: Microsoft Teams, ServiceNow, Slack, Box, GitHub, and Google Drive Software as a Service (SaaS) applications. VA currently utilizes the Netskope SaaS solution for Microsoft Office 365 (O365), ServiceNow, and SalesForce.com for security visibility and real-time data and threat protection for its Microsoft Azure and Amazon Web Services (AWS) cloud services and applications. This acquisition shall provide the VA Enterprise Cloud (VAEC) with additional Netskope subscription licenses for Microsoft Teams, ServiceNow, Slack, Box, GitHub, and Google Drive SaaS applications. VA has reached the current capacity threshold for previously procured Netskope subscription licenses, thus requiring additional capacity to be added through new Netskope subscriptions. These licenses shall provide API access, additional collaboration capability and the same security functionality as the existing Netskope application.

The period of performance for this effort shall be 12 months with two 12-month option periods. The total estimated value of the proposed action is $-----, inclusive of the option period.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this Justification, it was determined that limited competition is available among resellers for the required brand name Netskope API subscription licenses. ECSO and VA Cyber Security Operations Center (CSOC) presently utilize the Netskope infrastructure for O365, ServiceNow, and SalesForce.com for SaaS applications for security visibility, real-time data and threat protection for its Azure and AWS cloud services and applications in the VAEC. Only Netskope subscription licenses can expand the capabilities of the existing solution to provide security and DLP for Microsoft Teams, ServiceNow, Slack, Box, GitHub, and Google Drive. Utilizing Netskope for these SaaS applications enables VA to apply existing Netskope platform subscription capabilities, including advanced DLP for Threat and separately for Malware protection controls immediately with minimal level of effort/labor cost; thus, providing a seamless integration with the current Netskope platform that is in production.

In October 2018 VA acquired the Netskope CASB operational tool and Netskope SaaS license solution to control DLP, Threat, and Malware protection controls for the VAEC. Since then, VA has invested two years and thousands of man hours implementing, configuring, and adopting the use of Netskope into numerous operational procedures while integrating Netskope with other VA SaaS applications. Any other solution would require VA to remove the current platform, baseline a new system and build new configuration and feeds for all VA and Office of Information Security (OIS) systems. This would require extensive testing and implementation within each environment as well as building APIs for the SaaS applications while establishing policies for use of the applications. VA would then need to procure SaaS user licenses for the alternate solution API connections and establish protocols and templates to communicate OIS reporting. Based on historical data and previous acquisition history, replacing the entire system and building new configuration and feeds for all VA and Office of Information Security (OIS) systems would take over three years at an estimated duplicative cost of approximately $5.3M. These duplicative costs would not be recovered through competition.

VA requires the urgent expansion of this mission to its existing efforts for DLP and transaction monitoring capabilities due to continuing COVID impacts. In addition, VA has an expected mission requirement growth for additional application migration operational tools which provide visibility and real-time data as well as threat protection when accessing cloud services. CASB requires Netskope, a specific CASB SaaS solution product to ensure security and privacy compliance of all cloud services in use today by VA applications, services, and employees. The required Netskope subscription licenses will provide the same security functionality in the form of audit logs, alerts, data classification and management of policies that is currently being provided for O365, ServiceNow and SalesForce.com. Only Netskope subscription licenses can expand the existing proprietary Netskope solution since no other licenses are compatible or interoperable with Netskope. If any other security and privacy software was used, it would not be compatible with VA’s current CASB operational tool. If the current security management effort is not expanded to utilize Netskope’s Microsoft Teams, ServiceNow, Slack, Box, GitHub and Google Drive SaaS applications package, the VA is at risk of incurring data and loss of monitoring of network traffic during the COVID-19 pandemic surge in activities. VA OIT needs to increase the capabilities of the CASB operational tool to prevent any data losses and to provide continuous monitoring of all transactions.

Netskope SaaS subscriptions also ensure the overall protection and security for Veteran’s data and while meeting VA Trusted Internet Connection 3.0 information security standards, guidelines, and initiative efforts to include future technology growth/advancement standards of the VA IT Infrastructure. In addition, the required Netskope API licenses support and address the Office of Inspector General (OIG) findings of security vulnerability concerns from Federal Information Security Modernization Act Audit. The Netskope licenses would reduce potential security vulnerabilities and successfully eliminate the OIG potential information security protection concerns.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in Section 8 of this Justification. This effort did not yield any additional solutions that can meet the Government’s requirements. It was determined, however, that limited competition is anticipated among resellers for brand name Netskope products. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, OIT ECSO will continue to monitor market trends, new/emerging products, and services for availability of other solutions to meet VA needs.

8. Market Research: The Government technical experts conducted market research from December 2020 to May 2021 via internet searches to ascertain the ability of any other sources besides Netskope. Market research consisted of a review of similar SaaS products to include those from Mcafee, BitGlass, and Cipher Cloud. Though these alternative vendors offered similar solutions, none of them can meet VA requirements due to the interoperability and compatibility constraints as detailed in Section 5 of this justification.

Further, a Request for Information (RFI) was issued on December 16, 2020, via the NASA SEWP V website to ascertain if there were sources that could meet the Government’s technical requirements for brand name Netskope products. The RFI closed on December 28, 2020 with 4 responses received. Four quotes were received; however, one quote was for a GitHub product and the vendor was not an authorized reseller of Netskope. GitHub is a file or code-sharing service for collaboration purposes, and it is not a security product. Based on the information provided, the Government Program Manager determined three vendors (MetGreen, Anacapa Micro Products, and Four Points Technology, LLC) to be authorized resellers of the required brand name Netskope products and technically capable of performing the effort. Two of the three contract holders who responded to the RFI with valid quotes are Service-Disabled Veteran-Owned Small Businesses (SDVOSBs).

Additional market research was conducted in March 2021 utilizing the NASA SEWP V GWAC Provider Lookup Tool to identify NASA SEWP resellers that could provide the required Netskope license subscriptions. The search yielded five Netskope resellers capable of providing this requirement that are SDVOSB contract holders and registered and verified in the Vendor Information Pages (VIP) database; therefore, limited competition is expected among SDVOSBs for this proposed action. Furthermore, market research was conducted on the VIP database which found that two or more VIP verified vendors can meet the Government’s requirements under North American Industry Classification System code 541519.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date: ________________________________

Director Signature: ____________________________

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this DO action will be fair and reasonable based on the fact that contracts awarded on NASA SEWP V GWAC have already been determined to be fair and reasonable. As there are numerous potential vendors on NASA SEWP V GWAC, price competition is anticipated. Finally, the successful quote will be compared to the Independent Government Cost Estimate.

Date: ________________________________

Procuring Contracting Officer Signature: ____________________________

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Date: ________________________________

Procuring Contracting Officer Signature: ____________________________

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Netskope API subscription licenses on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: ____________ Signature: _________________________________

Advocate for Competition Technology Acquisition Center Office of Procurement, Acquisition, and Logistics

Page 1 of