Okta_Identity_Cloud_Solution_JA Redacted.pdf

Okta IDaaS Solution Control Number VA-24-00026980

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-wide Acquisition Contract (GWAC) for the procurement of brand name Okta Identity Cloud Identity-as-a-Service (IDaaS) active Monthly Access User (aMAU) licenses and associated technical support for ongoing maintenance of existing operations. The aMAU licenses include both Workforce Identity Cloud (WIC) and Customer Identity Services (CIS).

3. Description of the Supplies or Services: VA, Office of Information and Technology, Product Engineering Services (PES) requires the renewal of existing and procurement of new brand name Okta Identity Cloud IDaaS, which includes aMAU licenses, directory services, Application Programming Interface (API) access management, Single Sign-On (SSO), adaptive Multi-Factor Authentication (MFA), federation from multiple different credentials providers, device access, lifecycle management, access gateway, registration, reporting and logging for use on multiple organizational platforms, and associated technical support. VA currently utilizes the Okta IDaaS solution to meet these requirements for the Office of the Chief Technology Officer (OCTO) supporting DevOps Tools Suite (DOTS) and PES supporting the Lighthouse API platform as well as Cloud Computerized Patient Record System (CPRS) and Personal Identity Verification (PIV)-exempt MFA. This IDaaS solution provides a single cloud-native, Federal Risk and Authorization Management Program (FedRAMP) Moderate-authorized, Software-as-a-Service (SaaS) Identity and Access Management (IAM) product with future capability for FedRAMP High-authorized organizational implementations for specific use cases. Okta will meet ongoing requirements for an Identity Provider to maintain existing operations including authentication, access management, automated administration, and reporting.

Okta WIC currently provides a seamless and secure sign-on experience for VA internal workforce users into VA applications. It allows users to authenticate with PIV or Authentication Assurance Level (AAL)2/AAL3 compliant authentication factors when accessing applications. Okta is currently being deployed as an alternate MFA method to eliminate Single-Factor Authentication (SFA) access to the VA network. Employing the alternate MFA strengthens VA's security posture against threat actors trying to gain access to its resources. This product is presently used by the Enterprise Cloud Solutions Office (ECSO) to support Cloud CPRS using MFA and by OCTO for authentication to tools supported by DOTS for approximately 32,000 WIC aMAU licensed users and a total user count of approximately 60,000 users.

Okta CIS, as currently deployed, allows VA to provide a seamless and secure identity experience for external users such as Veterans and caregivers as well as developers that create digital products on behalf of VA. It allows for self-service registration, social login, identity verification, and consent management. VA PES currently requires the renewal of 1,100,000 CIS aMAU licenses to support the Lighthouse API platform.

The renewal of existing Okta aMAU licenses, utilized during the previous contracts, are necessary to authenticate end users of these mission critical VA application platforms.

Okta supports Credential Service Providers selected by VA, including, but not limited to, ID.me and Login.gov.

In addition, VA requires Okta Professional Services which provide technical support and Okta subject matter expertise for the setup, configuration, deployment, and expansion of the Okta solution in the VA Enterprise Cloud. Advisory and project assistance may be in the areas of basic resource scheduling and coordination, ensuring secure access to target internal applications with Multiservice offerings, evaluating customer integration concerns and business requirements, MFA, SSO enable applications, data store integration(s), provisioning, user adoption, Org to Org, Uniform Resource Locator redirects, user and group assignments, application integrations, security policies, onboarding/off boarding flows, registration and login flows (including multi-factor), and Go-Live support. Additionally, Okta Professional Services shall include security analysis and administrative support to identify and mitigate risks and maintain VA Authorities to Operate (ATO).

The resultant Delivery Order will have a 12-month Base Period with 2 12-month option periods, each with a quantity of aMAU licenses required for un-interrupted operation of VA and third-party applications integrated with Okta. Optional tasks for Okta professional services will be included in both base and option periods to provide strategies for change management, technical support, and subject matter expertise.

To ensure that there is a sufficient number of aMAU licenses available to the Government for any organic growth of the existing use cases beyond the base requirement aMAU licenses, the Government will include optional tasks in the base and each option period, to allow a maximum ceiling of aMAU licenses for the contract period as follows:

WIC – 80,000 aMAU licenses CIS – 5,000,000 aMAU licenses

The total estimated price of the proposed action, inclusive of all option periods and optional tasks, including professional services, is .

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on extensive market research, as described in Section 8 of this document, it was determined that limited competition is viable among resellers for the brand name Okta Identity Cloud IDaaS aMAU licenses and associated technical support. The required Okta IDaaS is proprietary to Okta. VA contacted Okta in November 2023 to ascertain if the proprietary code was for sale. Okta advised that their proprietary code was not for sale. VA’s platforms, as listed in their current form, are specifically configured to utilize only Okta IDaaS aMAU licenses as the means of authenticating users. This acquisition is intended to support ongoing operation of systems currently integrated with Okta to avoid a lapse in service while VA works toward a fully competitive acquisition of an Agency-wide enterprise IDaaS solution and transitions to it. No other product can meet the technical requirements currently met by the Okta IDaaS solution, be fully operational in VA, and be integrated with the current systems for at least one to two years or longer, as further detailed below.

Only brand name Okta IDaaS can meet all of VA’s interoperability and functional capability requirements as currently deployed. VA’s API Management platform is deployed with cloud-based Sandbox and Production environments and an API developer portal and gateway that is publicly accessible and external to VA’s internal network. This platform is used by third-party applications and their developers to create digital products on behalf of VA by using APIs available through the gateway. VA’s API Management platform was developed internally based on use of Okta’s proprietary API.

If any alternate vendor’s product were used, VA would be required to redevelop the source code for the API management platform. Access to Okta’s proprietary code is necessary for the expanded environment to fully interoperate with the existing Okta Identity Cloud IDaaS currently fielded, without severely compromising the operational integrity of the currently deployed solution and the over 200 internal and third party applications that are currently utilizing it.

The Okta IDaaS leverages an industry unique combined stack of IDaaS services including API SSO components, API authorizations, and API gateway integrations that will only interoperate with Okta’s proprietary code. Any other brand name IDaaS software utilized to support the platform would neither communicate nor function properly with the existing Okta solution due to the aforementioned proprietary constraints. Use of any other brand name IDaaS would require a complete replacement of the currently fielded products and a significant reengineering of the API Management Platform, which would result in extensive delivery delays. Specifically, VA would require extensive planning activities to determine the necessary configurations for the new solution, reconfigure network settings and security configurations accordingly, develop, engineer, secure and build a new working solution, conduct functional and security testing of the new solution, complete a new ATO in Risk Vision, and work with over 60 external developers currently utilizing Okta in the sandbox and an estimated 142 plus applications in production to adopt the new solution. It would also require significant retooling of the current technology stack resulting in a reduction of the number of apps that VA provides to serve Veterans regarding their healthcare, benefits, verification, and cemeteries services. This change would result in a significant gap in service of approximately 12 months along with an estimated cost of $13.39 million for re-integration efforts, broken down into $2.84 million to re-integrate the VA API Management Platform and $10.55 million for re-integration efforts of the CIS solution.

These estimates are based on previous acquisition history.

Okta’s WIC product is currently implemented in support of secure access for CPRS, AppStream, and Veterans Information Systems and Technology Architecture (VISTA) as well as a number of SaaS tools managed by DOTS, and fulfills the requirement of allowing users to seamlessly authenticate with PIV or AAL2/AAL3 compliant authentication factors. Okta is the only product that meets VA’s two-factor authentication requirement and integrates with AppStream in such a way that the user is automatically directed to a secure launch pad with their unique custom provisioned CPRS application. Okta is also currently deployed as an alternate MFA method to eliminate SFA access to the VA network. Employing the alternate MFA strengthens the VA's security posture against threat actors trying to gain access to its resources. VA also requires that an Identity Provider (IdP) integrate and manage identities and groups to and from Active Directory and other authoritative data sources. The VA team has already integrated Okta with VA’s Active Directory system. The work involved to integrate, test, and verify that a product other than Okta could meet all of the requirements for the existing implementations requires highly skilled Information Technology and Security professionals and is time consuming. VA estimates performing this analysis would cost between $250,000 to $500,000 in subject matter expert labor alone and would require 6 to 9 months of extensive evaluation and comprehensive product integration, development, and testing of both the interfaces with AppStream, CPRS, all VA network access methods, VA Active Directory, a variety of Government Furnished Equipment (GFE) and Non-GFE equipment, and a variety of location combinations. If an alternative solution were implemented, the cost to implement a different technical solution would be an estimated $4.8 million for both ECSO and DOTS. These estimated costs and timeframes are based on previous acquisition history. Moreover, switching to an alternative without the ability to extend the use of Okta beyond currently available contracts would lead to a lapse in service for those applications.

In addition to VA’s additional costs, rebuilding the current API platform to use a different IdP would require significant work on the part of these third-party vendors to update and test their applications to be compatible. If any of the third-party vendors did not have the financial or labor resources to make the updates, this could result in a reduction in the number of important applications available to Veterans such as third party Apple Health applications, Tyler Tech, VA Online Scheduling, VA Flagship Mobile App, USAA, Humana, and Sync.MD.

Therefore, as detailed above, use of any alternative product while maintaining the existing WIC and CIS solutions for a minimum of two years is estimated to cost $18.19 million, as well as additional estimated costs to update dozens of third-party Veteran applications. These estimated duplicative costs would not be recouped through competition.

Additionally, only Okta has access to Okta’s proprietary code base to provide the required technical support for the existing Okta IDaaS. This proprietary code is needed to ensure all services provided are properly configured. Accordingly, Okta is the only IDaaS provider that meets all of VA’s identity and access management, interoperability, functional, FedRAMP, and maintenance requirements, as stated above. As noted, a transition from Okta is an effort that would require detailed enterprise planning in order to avoid disrupting continuity of operations. Failure to renew these Okta aMAU licenses would result in VA being unable to continue to operate, configure, and maintain its own software for mission critical applications inclusive of the Cloud CPRS patient care platform.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however that limited competition is available among resellers for brand name Okta IDaaS aMAU licenses, as well as associated technical support. In accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the resultant Delivery Order will be synopsized and the justification will be made publicly available on the Contracting Opportunities page within 14 days of award of the order.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to perform market research to determine if there are any new products available that are capable of fulfilling the Government’s requirements. The Government is also currently in the market research process for an Agency-wide enterprise IDaaS solution, for which a Request for Information (RFI) was released in May 2024 and ongoing market research efforts are being conducted. The requirements currently met by Okta would eventually be fulfilled by the Agency-wide enterprise solution.

8. Market Research: The PES team has released two RFIs in the process of conducting market research. This research included an RFI released in November 2023 seeking product alternatives to the brand name Okta IDaaS solution, as well as an updated RFI released in May 2024 looking for modern IAM solutions that could meet VA’s requirements for an Agency-wide IAM solution. The VA technical experts reviewed the RFI responses which included similar software solutions from IBM, CyberArk, and UberEther and determined that they cannot meet VA’s current required software needs because alternative vendors cannot access the proprietary source code and technical data of Okta’s proprietary code in use at VA or that of its third-party applications for Veteran services. The current Okta IDaaS solution will not interface with any other vendors’ IAM software solution. The use of any other IDaaS software product would severely degrade VA’s ability to support and manage the existing IDaaS capabilities, which would result in interoperability and compatibility issues. IDaaS software solutions from any other vendors would require an extensive and complex redesign, development, and integration of a new VA enterprise-wide IAM software solution. Any alternate solution from another vendor would be a cost prohibitive and high-risk alternative as it would require developing a proprietary IAM solution working through a cradle-to-grave software development life cycle for VA’s current IDaaS software solution with the potential for significant delays in providing access to critical services for Veteran users. The impact would be a complete redesign of the VA IDaaS solution, which would take an estimated one to two years to complete and require a substantial dollar amount of new investment. The current system would still need to be up and available while redesigning the new system, resulting in unnecessary duplication of costs and possible system downtime and/or loss or degradation of data as the system migrated. Each software developer offers a proprietary system and associated services that will only operate with its respective hardware and software. Based on this market research, only Okta maintenance and technical support can meet VA’s technical requirements.

Discussions and market research continues with vendors in preparation for the Agency-wide enterprise IAM acquisition. However, in order to ensure continuity of operations and avoid a lapse in service, VA must be able to acquire Okta licenses to support the existing applications already using Okta, while an Agency-wide enterprise IDaaS solution is acquired, granted a VA ATO, deployed, and integrated with existing Okta-integrated applications.

Additional market research was conducted in January 2024 utilizing the NASA SEWP V GWAC Provider Lookup Tool, which resulted in the identification of multiple Service- Disabled Veteran Owned Small Business (SDVOSB) resellers of Okta brand name products. Use of the NASA SEWP provider lookup determined 11 SDVOSB resellers can provide the brand name Okta IDaaS solution. Therefore, limited competition is expected among SDVOSBs for this proposed action.

In summary, based on the totality of the market research, it was determined that no other products can meet VA’s identity and access management, interoperability, functional, and maintenance requirements, as outlined in Section 5 of this Justification.

Accordingly, Okta IDaaS was determined to be the only product that could meet VA’s requirements as set forth above.

9. Other Facts: None