(P03) JA Palo Alto Firewalls (VA-21-00020279) Final (002).mf Redacted.pdf

Palo Alto Network Firewall Security Equipment

Control Number: VA-21-00020279

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement Acquisition and Logistics

Technology Acquisition Center

23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed-priced delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name Palo Alto Networks, Inc. (Palo Alto) firewall security equipment, support and Threat Prevention software subscriptions at the Veterans Integrated Service Network (VISN) VA medical centers (VAMCs).

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA) Office of Electronic Health Record Modernization (OEHRM) requires brand name Palo Alto Networks firewall security equipment, support and Threat Prevention software subscriptions. These requirements do not include any type of product development or installation services. There are approximately 674 Palo Alto firewalls deployed in 337 VAMCs/Clinics to facilitate their secure connectivity to the Cerner data center and access to the new Electronic Health Record (EHR).

OEHRM is securely connecting VA medical centers and clinics to the Cerner data center where the EHR solution is being hosted. The hosting environment is jointly managed by the Department of Defense (DoD) and VA. To comply with Federal Law, (the 2008 National Defense Authorization Act), requiring DoD and VA interoperability of health record systems, the VA and DoD are implementing a jointly managed EHR using Cerner’s Millennium solution. This solution is hosted in the Cerner Data Center. Access to the jointly managed EHR is achieved by connecting to the DoD’s Medical Community of Interest (MedCOI) network.

MedCOI which is a virtual network with detailed technical specifications and operational procedures implemented to ensure privacy of protected health information as required by the Health Insurance Portability and Accountability (HIPAA) Act of 1996 and other federal laws and regulations.

The joint management of the EHR requires, in part, that DoD and VA work together to ensure operational availability, performance and security of the infrastructure supporting the EHR. In furtherance of this requirement, on February 13, 2018, the VA and DoD signed the DoD/VA Joint Electronic Health Record Architecture Description, which established the common security architecture for VAMCs/Clinic and MedCOI connecting to the EHR system. This common architecture, known as the Joint Security Architecture (JSA), enables the VA and DoD to create a common management environment allowing each organization to meet its obligations for availability, performance and security within its domain of control while having visibility into the partner organizations domain of control.

The Palo Alto Networks firewalls, Premium Support and Threat Prevention subscriptions, shall be used to support the migration of multiple VISN sites from the Veterans Health Information Systems and Technology Architecture (VistA) to the new EHR. The Online support portal and 24 x 7 x 365 phone and email support are part of the 3-year Premium service that VA firewall administrators use for installation support, parts replacement, software fixes and implementing feature releases. In addition, the Threat Prevention subscription works in conjunction with the Panorama to provide proprietary cloud-based services, Intrusion Prevention System (IPS) and software analytical tools to protect the VA enterprise from multiple threats and network attacks. Delivery of the required Palo Alto equipment is due 30 calendar days after award. The period of performance for hardware and software support shall be 36 months following the final installation of the hardware and software. The total estimated price of the proposed base action is $5,600,051.70 to procure 30 Palo Alto firewalls and associated Premium Support and Threat Prevention subscriptions to deploy in approximately 15 VAMCs/Clinics. Optional quantities with an estimated price of $18,666,839.00 are included to procure up to 100 additional Palo Alto firewalls and associated Premium Support and Threat Prevention subscriptions to deploy in approximately 39 VAMCs/Clinics currently scheduled for deployment this fiscal year. The optional quantities may be exercised at any time, from time to time, within 12 months after receipt of award up to the not to exceed maximum quantity. Including the optional quantities, the total estimated value of the action is $

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR)

16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41

U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Item 8 of this justification, it was determined that limited competition is available among resellers for this requirement. The Palo Alto firewalls are part of the existing JSA implementation and common management environment. The existing security architecture is managed and administered through a Palo Alto Panorama Management console which provides the common management environment. Communications between Panorama and the firewalls is proprietary to Palo Alto. The configuration language is proprietary to Panorama and cannot be replicated by other Original Equipment Manufacturers (OEM) as it relies on proprietary software. Additionally, the security event reporting language is also proprietary to Palo Alto as it also relies on Palo Alto proprietary software.

Panorama is used to manage and configure all VA Palo Alto firewalls centrally through a browser-based interface. The centralized management also provides for the distribution of software updates and real-time changes to firewall rules and policy editing to accommodate new vulnerabilities. In addition, the centralized management capability in Panorama significantly removes firewall issues caused by misconfiguration. Once a configuration is tested and accepted, it can be loaded and distributed to all firewalls in the Panorama node. Furthermore, as firewalls capture information in logs on source and destination internet protocol addresses, protocols and port numbers used to help the DoD/VA investigate an attack, Panorama aggregates the logs and creates a single display for actionable visibility across multiple firewalls, no matter where they are deployed. No other OEM’s firewalls can interoperate with the Panorama management console with the same configuration and event reporting functionality. Further no other OEM’s management platform can manage VA and DoD’s Palo Alto firewalls. Using another OEM’s firewall will require both VA and DoD to redesign and reimplement the JSA. VA cannot require the DoD to redesign and reimplement the JSA, therefore this requirement must operate with the existing architecture or environment; only Palo Alto firewalls meet the VA’s requirement for a common management environment. Furthermore, the support and threat prevention software is only interoperable with the Palo Alto firewalls and such can only be provided by Palo Alto or a reseller. Failure to procure Palo Alto firewalls will negatively impact the deployment and Go-live schedule developed for VAMCs/Clinics at VISN sites to connect securely to the Cerner data center and access the EHR, place the VA in the posture of violating the “2008 National Defense Authorization Act”, and adversely affect the ability of Healthcare workers at VAMCs/Clinics which are not connected the Cerner data and don’t have center access to the EHR to provide proper healthcare to Veterans.

6. Efforts to Obtain Competition: Market Research was conducted, details of which are in Item 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical experts determined that limited competition is available among authorized resellers for brand name Palo Alto firewalls. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, OEHRM will continue to monitor market trends, new/emerging products, and look for compatible and more advanced technologies to meet VA needs.

8. Market Research: The technical experts reviewed alternative products to Palo Alto

Networks products in September 2020, which consisted of Fortinet and Cisco.

While other networking hardware and software solutions from alternative manufacturers exist, they do not meet VA’s requirements as outlined in Section 5 of this Justification, because only Palo Alto Networks or a reseller has access to the proprietary communication protocol that the Panorama central management software uses to manage the Palo Alto firewalls currently in place across VA. In addition, VA technical experts regularly review industry trade publications and conduct internet research to ascertain if any other brand name equipment is available. Market research revealed that only Palo Alto Firewalls, support and software can be added to the VA’s infrastructure without disrupting the existing architecture and environments.

Request for Information (RFI) was issued on July 22, 2020 on the NASA SEWP V GWAC. The RFI # 162050 closed on July 29, 2020, and three contract holders provided quotes: MetGreen Solutions, ThreeWire Systems and Veteran Information Technologies. All three contract holders who provided quotes are Service-Disabled Veteran-Owned Small Businesses (SDVOSB). Additional market research was conducted in August 2020 by the Contract Specialist utilizing the Provider Lookup tool on the NASA SEWP V GWAC website which identified several resellers of the required brand name Palo Alto equipment, support and software including multiple SDVOSB contract holders from Group B(2). Based on the results of the market research, the solicitation will be issued on NASA SEWP to Group B(2) contract holders.

Based on the market research efforts, the Government’s technical experts have determined that only brand name Palo Alto firewall security equipment, support and Threat Prevention software subscriptions can meet all the VA’s needs. Market research determined that limited competition is viable among resellers for the brand name Palo Alto Networks products.

9. Other Facts: None

Digitally signed by JUAN C.

JUAN C. QUINONES 165185 QUINONES 165185

Date: 2021.02.08 08:31:36 -05'00'

JUAN C. Digitally signed by JUAN C.

QUINONES 165185 Date: 2021.02.08 08:32:00 -05'00'

QUINONES 165185

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Daniel J. Mesimer Date:

Director WAN/LAN Infrastructure

2/3/21

Daniel J. Mesimer Digitally signed by Daniel J.

Mesimer 107298

Engineering & Provisioning Signature: 107298 Date: 2021.02.03 11:22:20 -06'00'

11. Fair and Reasonable Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition. Additionally, NASA SEWP V GWAC has already determined the prices on contract to be fair and reasonable. Finally, the successful quote will be compared to the Independent Government Cost Estimate.

Juan Quinones Date:

2/8/21

Procuring Contracting Officer Signature:

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Juan Quinones Date:

2/8/21

Procuring Contracting Officer Signature:

Approval

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby approve the acquisition of brand name Palo Alto firewall security equipment, support and Threat Prevention software subscriptions at multiple VISN VAMC on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

MICHELE R. Digitally signed by MICHELE R.

FOSTER 149195

Date: Signature: FOSTER 149195 Date: 2021.02.08 13:24:10 -05'00'

Michele R. Foster

Head of the Contracting Activity Technology Acquisition Center Office of Procurement, Acquisition, and Logistics