CONTROL NUMBER: VA-26-00044009

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm fixed price Delivery Order

(DO) to be issued under the National Aeronautics and Space Administration (NASA) Solutions for an Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name HashiCorp (now an IBM company) Terraform and Vault Integrated Solution consisting of software with standard maintenance and gold support.

3. Description of the Supplies or Services: VA, Financial Services Center (FSC) requires the purchase of brand name HashiCorp Terraform and Vault Integrated Solution consisting of annual software subscriptions with standard maintenance and gold support. FSC runs hybrid workloads from local FSC servers and the cloud, performs disaster recovery, ensures site continuity capabilities, and ensures orchestration and automation of applications and workloads to reduce operational costs. To ensure the additional security needed to perform these functions within Information and Technology (IT) Industry security practices, FSC requires brand name HashiCorp Terraform Enterprise Platform Self-Serve Infrastructure Governance & Policy software with maintenance support integrated with Vault Enterprise Platform Multi-Datacenter & Scale Governance & Policy software with maintenance support and Vault Enterprise Platform (Non-Prod) software with maintenance support. Best IT industry security practices include placing secrets, tokens, passwords, certificates, encryption keys, variables, state versions and other sensitive data into HashiCorp Terraform configuration or state files. Development and Operations (Dev/Ops) staff who want to include rapidly changing or highly sensitive configuration data on managed systems can connect directly and securely from Terraform to Vault. The Contractor shall provide Gold Support Service Subscription for maintenance support of HashiCorp Terraform and Vault Clients. The Gold Support Service Subscription shall entitle VA FSC personnel to the following support services: Customer Support Center hours from Monday through Friday, 9:00 a.m. to 5:00 p.m. Customer support shall consist of both phone and online support.

Contractor shall provide all software updates and patches during the period of performance.

The performance period will run from August 1, 2026, through July 31, 2027, for the base period, with one (1) 12-month option period. An optional task may be exercised during both the base and option period at the Government’s discretion.

The total estimated value of this action is , inclusive of the option period and optional task.

4. Statutory Authority: This brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

HashiCorp CONTROL NUMBER: VA-26-00044009

4106(c)(2) as implemented by Federal Acquisition Regulation (FAR) Overhaul VA Deviation 16.507-6(b)(2), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based upon market research, as described in Section 8, it was determined that limited competition is available among resellers for brand name HashiCorp Terraform and Vault Integrated Solution of software and maintenance support. Only brand name HashiCorp Terraform and Vault software and maintenance support will meet VA’s requirements due to compatibility and interoperability constraints associated with this proprietary solution.

As the FSC continues to expand into multi-platforms for infrastructure, the complexity and challenge of deployment to different platforms increases, and existing infrastructure management tools are largely provider specific. Terraform is the only provider-agnostic configuration orchestration and infrastructure management tool which will allow a single configuration to be used to manage systems in multiple clouds from multiple providers/services and other third-party services to be combined and composed simultaneously using a single unified syntax in a JavaScript Object Notation based configuration files with resource graphing and high-level datacenter abstractions into easy and reliable deployments. Terraform handles the cross-cloud dependencies, in addition to on premise. FSC compiles information from various cloud platforms. Since Terraform is provider-agnostic, it can interact with a variety of products and manage the information into a single configuration. Terraform is currently in use at FSC as a solution to simplify management and orchestration of a large-scale on premise and multi-cloud infrastructure.

Vault is an enterprise-grade secrets management solution that securely brokers access to systems for both humans and applications through programmatic interfaces. It enables the storage and dynamic generation of secrets, as well as encryption key management, allowing keys to be used as a service without exposing the underlying key material. Currently in use at FSC, Vault provides a critical security capability by centrally managing credentials, such as passwords, usernames, and other sensitive information, which can be accessed securely by Terraform and other systems. Using Terraform without Vault would introduce an increased risk of exposing security secrets. When used together, IT products like Terraform and Vault provide maximum functionality within their own production environment and cannot interoperate in a mixed vendor variety of licensing model or configuration while maintaining the central management requirement from the existing product. In order to prevent interoperability issues, VA requires the software to be integrated together so that they function within the existing Terraform solution. Terraform and Vault provide a better DevOps/Development Security and Operations experience through managed infrastructure, fast replication, and near real-time deployment changes Terraform and Vault are required for VA FSC cloud infrastructure/orchestration operations management.

The associated standard maintenance and gold support for the software are needed to keep the software fully functional and operational. The maintenance support for brand name HashiCorp Terraform and Vault software is essential to the seamless compatibility and operations with software and applications already deployed and used across FSC. Only HashiCorp or an authorized reseller can provide maintenance support on the Terraform and Vault software as they have access to the proprietary data to include the source code. VA does not possess the proprietary technical data and code for the software to offer to a non-original equipment manufacturer. Without this technical data, no other source has the ability to provide the brand name HashiCorp Terraform and Vault Integrated Solution consisting of annual software subscriptions with standard maintenance and gold support. Failure to acquire the standard maintenance and gold support would prevent obtaining software upgrades and risk interoperability concerns:

a. Avoidance of Service Disruption to Mission‑Critical and Veteran‑Facing

Systems: Terraform and Vault currently underpin the configuration, provisioning, and secrets management for production and development environments across VA. Replacing them with a different Infrastructure as Code (IaC) and secrets platform would require re‑architecting state files, modules, identity mappings, and pipeline logic. Migration errors are highly likely to disrupt application availability or degrade performance, directly affecting Veteran‑facing services and internal operations.

b. Avoiding Breakage of Critical CI/CD Pipelines and Automation Workflows: VA deployment pipelines depend on Terraform/Vault‑specific providers, workflows, plan/apply semantics, and secrets‑injection patterns. A different IaC product may not provide the functional parity required to maintain these pipelines. Breakage of automated deployment workflows would reduce delivery velocity for application teams and create operational instability.

c. Retention of Institutional Expertise and Avoidance of Productivity Loss: The VA has invested years of workforce development, training, module engineering, and process standardization around Terraform and Vault. Moving to an alternative solution would require retraining large segments of the workforce, reduce productivity and increase error rates until equivalent skill levels are achieved. This represents measurable operational harm.

d. Prevention of Long‑Term Lock‑In and Loss of Rollback Capability: Once infrastructure state and secrets management are migrated to a new vendor solution, rollback to Terraform and Vault becomes infeasible. If the alternate solution fails to meet technical, security, or compliance requirements, VA would be locked into a platform that cannot support mission needs. Maintaining Terraform and Vault avoids this irreversible risk.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name brand name HashiCorp Terraform and Vault Integrated Solution consisting of annual software subscriptions with standard maintenance and gold support. Furthermore, the proposed action will be synopsized on the Contracting Opportunities Page in accordance with FAR 5.201. Any proposals that are received shall be evaluated.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be completed.

8. Market Research: VA, FSC technical experts conducted market research in

December 2025. Competition in the network infrastructure management and orchestration space is limited to specific individual products that are limited in the environments that they can manage. With the use of www.Gartner.com, VA FSC Technical Experts determined no other tool on the market can manage resources in multiple cloud platforms like Terraform. FSC technical experts compared SlickStack and Cloudify infrastructure management software, but neither of these software tools can meet all of the FSC functional requirements for managing the infrastructure across the many storage platforms that are currently in use like Terraform can since it is provider-agnostic. Other software packages like Puppet and Chef are configuration management tools. Vault was compared to products from Bitdefender Total Security, HashCalc, KeePass, and Tripwire Enterprise. No other secrets management solutions had the flexibility and functionality to integrate with Terraform and provide maximum security. No other products met all the FSC requirements for DevOps architecture systems and the required services. Based on this market research the Government’s technical experts have determined that HashiCorp’s brand name Terraform and Vault Integrated Solution is the only source that can meet the Government’s requirements. Switching to alternative products or running mixed environments would lead to application limitations, tool limitations, learning curves, migration complexities and in-house resource requirements.

Additional market research was conducted in January 2026. During this process, the Contracting Officer’s Representative (COR) used the NASA SEWP V Provider Lookup Tool to identify 26 Service-Disabled Veteran-Owned Small Business (SDVOSB) contract holders authorized to resell the required HashiCorp Terraform and Vault software, along with accompanying maintenance support. As a result, limited competition is anticipated. Furthermore, a market research request was posted to NASA SEWP on December 29, 2025, and closed on January 16, 2026.

Seven (7) quotes were received in response—all from SDVOSB resellers that were found capable of providing the required requirements.

In March 2026, the Contract Specialist (CS) conducted market research using the same tools as the COR, including the NASA SEWP V GWAC, to identify vendors capable of meeting the requirement. Based on the market analysis, the CS identified 21 SDVOSBs with the capability to validate requirements and fulfill the order. As a result, limited competition is anticipated among NASA SEWP V GWAC resellers.

9. Other Facts: None http://www.gartner.com/

10. Technical/Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of knowledge and belief

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition. Additionally, NASA SEWP V has already determined the prices on contract to be fair and reasonable. Finally, the successful quote will be compared to the Independent Government Cost Estimate

12. Contracting Officer Certification/Approval: I certify that this justification is accurate and complete to the best of my knowledge and belief. “This contract action exceeds the simplified acquisition threshold, but does not exceed $750,000, therefore, the certification required by FAR 16.505(b)(2)(ii)(A) serves as the Contracting Officer’s approval.

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY