P03 JA_Redacted.pdf

RedSeal Subscription Licensing and Support Control Number VA-25-00011826

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a Firm-Fixed Price delivery order (DO) to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for brand name RedSeal subscription licensing, engineering support, training, hardware and software licensing, maintenance and installation upgrades for the architecture, and implementation and integration need for the cloud. Hosting will be provided by VA.

3. Description of the Supplies or Services: The proposed action is to provide subscription license renewal for all on premise Layer 2, Layer 3 and cloud infrastructure.

The action also provides engineering support, training, hardware and software maintenance, and installation upgrades for the existing infrastructure, and integration needs for the cloud. Hosting will be provided by VA. VA requires a cloud based solution that will identify, assess, prioritize and remediate risks across the network through network mapping, Common Vulnerability Scoring System (CVSS) risk and exposure scoring with integrations with mainstream cyber, visibility, and for dual-based network.

The product is required to provide actionable attack path simulation, security posture validation, automated compliance monitoring, network-wide visibility, and continuous validation of hybrid network security posture. In addition, the solution is required by VA to be in compliance with the Federal Information Security Management Act requirements as well as Secure Technical Implementation Guides. The robust vulnerability detection capability of the network, through integrations with firewall and network devices automates a broad range of services for comprehensive, fully integrated cybersecurity management, including controls, scorecard measurement, dashboard reporting, and generating reporting metrics. The support services will assist VA in the collection and analytics reporting for VA network, hardware and software maintenance providing product updates, security patches, operating system upgrades and replacement parts. The period of performance shall be 12-month from the date of award with one 12-month Option Period. The total estimated value of this proposed action is , inclusive of the Option Period.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is available among authorized resellers for the required brand name RedSeal products.

RedSeal has continued to provide seamless integration into all VA’s multi-tiered risk and vulnerability detection architecture. The tool delivers updated network visualization and reporting to detect, document, and provide actionable intelligence to information system owners on critical risks located on the network. RedSeal provides Federal regulatory compliance with Federal Information Security Management Act requirements as well as

Secure Technical Implementation Guides both which are required by VA. RedSeal is currently the only product within VA that integrates, supports and is deployed with VA’s

Enterprise Mission Assurance Support Service (eMASS) current Governance Risk

Compliance (GRC) tool. VA estimates the lifecycle/utilization of the GRC tool to be an additional 10 years based on its current forward design functionality and architecture support framework. This estimate is based on the current Defense Information System

Agency’s interagency agreement and the lifecycle plan for the eMASS platform. GRC is the tool VA uses for their Assessment and Authorization program to document security controls, risks, vulnerabilities, and to document and issue Authorizations to Operate.

GRC consists of modules for compliance, assets, threats and vulnerabilities, policy, and reporting. GRC requires that reports from the installed cybersecurity solution provide metrics by system boundary to the device level to show overall and downstream risk.

RedSeal is currently the only tool that provides a comprehensive network map both in the cloud and on-premise with risk/exposure and threat analytics across the interconnection communication paths across VA’s network. Infrastructure and architecture functionality restrictions exist where only additional RedSeal brand name can meet existing VA’s RedSeal’s central management and licensing model. The current RedSeal infrastructure supports the ongoing VA technical requirements of agentless, appliance based, no administrator overhead dependencies. Only through continuing the established invasive security architecture with maximum visibility and expedited near real-time IT Security vulnerability threat modeling will allow critical risk reviews and responses to take place and enable VA to understand potential threats to

VA systems. In addition, RedSeal solution is the only solution that meets both the technical requirements, and the cybersecurity risk network mapping capability related to path based exposure, network attack path visualization, risk remediation prioritization, and network segmentation policies supporting zero trust. To deploy an alternative solution is estimated to take two years to include server deployments, licensing allocations, configurations to network infrastructure, including re-accreditation of the infrastructure systems and require an estimated $10 million in duplicative costs. These estimates are based on previous acquisition history. The estimated duplicative costs would not be recovered through competition. The use of any other solution would require specific capabilities in cyber threat analytics therefore exposing the VA network to increasing cyber risks, threats and vulnerabilities.

Furthermore, only RedSeal or an authorized reseller can provide the maintenance and support services under this proposed action since access to the RedSeal proprietary source code is required. No other original equipment manufacturer has access to the

RedSeal proprietary source code that is needed to provide the operational requirements for sustainment, maintenance and overall health of the technology. Access to this code is required to ensure all the services provided are properly configured. If RedSeal is removed the security of veterans’ data will be impacted by the VA not having visibility to learn unknown attack paths, improper network segmentation, inaccurate risk prioritization, and delayed incident response.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name RedSeal, as well as software maintenance and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace or VA’s enterprise and architectural posture that would enable future actions to be competed.

8. Market Research: Market research was conducted from February 2025 through May 2025 to determine if there are viable sources other than brand name RedSeal who could provide the subscription licensing, engineering support, training, hardware and software licensing, maintenance and installation upgrades necessary that could meet VA’s requirements. The technical experts reviewed similar products and brands such as Skybox, Tufin, AlgoSec, and FireMon. Skybox and Tufin both lack the capability to provide full topological modeling with reachability paths FireMon and AlgoSec both lack the capability to build a comprehensive network map that is a mirror image of the current network. These other products have limitations to actionable attack path simulation, security posture validation, automated compliance monitoring, network-wide visibility, and continuous validation of hybrid network security posture. In addition, none of these brands can provide the maintenance and support required without access to the proprietary source code for RedSeal products. RedSeal is the only source able to maintain the proprietary source code required for maintenance and support to the current VA infrastructure. As such, only brand name RedSeal will meet the Government’s needs.

Additionally, market research was conducted in April 2025 through the use of the Provider Lookup Tool on the NASA SEWP V GWAC web site to determine whether the brand name RedSeal is available from NASA SEWP V GWAC Contract holders. It was determined that are several approved Service-Disabled Veteran-Owned Small Businesses (SDVOSB) resellers of the brand name RedSeal that hold current GWACs.

Therefore, limited competition is expected among SDVOSBs for this proposed action.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on an analysis of proposed level of effort and mix of labor, will be conducted and subsequent negotiations will be held as necessary. Additionally, price discounts will be sought.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

13. Legal Sufficiency Certification: I have reviewed this document and find it legally sufficient, based on the representations set forth in the documents and, if any, attachments. The Advocate for Competition’s approval is an independently supported decision not wholly reliant on the legal sufficiency determination.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of RedSeal subscription licensing, engineering support, training, hardware and software licensing, maintenance and installation upgrades on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.