Zero Trust and Post-Quantum Compute Encryption (ZTA-PQC) — VA-26-0027030

6(b)(2), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on the market research described in Section 8 of this justification, the Government determined that the OEM maintenance entitlements, firmware, and partition licensing for the fielded Luna Network HSM appliances can be furnished only by Thales TCT or its authorized resellers, and that no similar product of another manufacturer meets, or can be modified to meet, VA’s need. The Government owns the fielded fleet, and this action sustains it rather than replacing it. The Government requires the Contractor to assume full maintenance responsibility for that equipment in its as-found configuration and firmware level upon completion of Transition-In, and to maintain continuous, uninterrupted coverage for every listed asset across the full period of performance with no lapse in entitlement at any renewal or option boundary. A maintenance entitlement for a specific manufacturer’s appliance is an attribute of that manufacturer’s own support program. No other manufacturer can issue a support entitlement against a Thales TCT appliance, provide advance replacement parts for it, or dispatch OEM-backed field service against

it. The restriction follows from the Government’s ownership of the installed base, not from any preference expressed in the requirement.

Furthermore, only OEM-sourced firmware preserves the FIPS 140-3 validation on which VA’s compliance posture rests. Each fielded appliance is a FIPS 140-3 Level 3-validated cryptographic module with an active NIST Cryptographic Module Validation Program (CMVP) certificate. The Government requires that any firmware applied to a covered asset be sourced directly from the original equipment manufacturer, and that no maintenance activity alter the validated hardware and firmware configuration, so that the FIPS 140-3 certification status of each module is preserved. The Contractor will further be required to verify the authenticity and integrity of every firmware or cryptographic library update using the OEM cryptographic signature and to reject any package that fails verification. A validated module’s certificate is issued against a specific hardware and firmware configuration. Firmware from any other source, however functionally similar, would place the module outside its validated configuration and void the CMVP certificate, which would in turn place VA out of compliance with the cryptographic module requirements applicable to its PKI and KMS operations.

Additionally, the PQC upgrade path for the fielded modules runs exclusively through the platform OEM. The Government requires that PQC algorithm firmware be supplied by the platform OEM within the validated cryptographic module and prohibits the Contractor from modifying validated module firmware. NIST finalized FIPS 203, FIPS 204, and FIPS 205 in August 2024, and VA requires in-field firmware upgrade of Government-furnished assets to those algorithms where technically supported by the OEM. PQC algorithm support inside a validated module is implemented by the module manufacturer and validated under that manufacturer’s CMVP and Cryptographic Algorithm Validation Program submissions. No third party can deliver a NIST-standardized PQC algorithm implementation into a Thales TCT module. Absent OEM firmware, the only route to PQC readiness for these assets would be wholesale hardware replacement, which this acquisition does not contemplate and which the

Government has determined is not warranted in advance of the PQC Readiness Assessment delivered in the base period.

Without OEM sustainment the fielded fleet runs unsupported. VA loses advance parts replacement, firmware and security patching, and the only path to post-quantum readiness. Further, a module that fails cannot be returned to its validated configuration.

These appliances are the root of trust for VA Public Key Infrastructure, Key Management Services, and certificate operations, so a failure at any gateway interrupts authentication and encryption for clinical and administrative systems across the enterprise.

Additionally, partition capacity on a Luna Network HSM appliance is enabled by a license Thales TCT issues against that specific appliance. One fielded appliance requires a partition license upgrade, and additional capacity may be needed during the period of performance. No other manufacturer can issue partition licensing against a Thales TCT appliance, so VA cannot meet this need with another company's product.

To replace the platform, the fielded appliances and their paired backup and administration kits would have to be bought again with a direct cost of roughly $ at current unit pricing before installation, which is representative of a portion of the overall costs. Key material inside a FIPS 140-3 Level 3 module cannot be exported in the clear, so moving to another manufacturer means generating new keys and re-enrolling every system that depends on them, including the VA certificate authorities, Key Management Services, and each application that holds a certificate or performs cryptographic operations against these modules. VA would run both platforms in parallel through that transition, revalidate the new platform, and retrain the staff who operate it, leading to a serious duplication of effort with an estimated cost well in excess of $ in the first year. The fielded HSM fleet is serviceable, Government-owned, and has no deficiency that early replacement before life cycle end would correct.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources which can meet this portion of the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among resellers for brand name Thales TCT that can furnish maintenance entitlements, firmware, or partition licensing for the fielded Luna Network Hardware Security Module (HSM) appliances. In accordance with FAR RFO Deviation 16.507-7(c)(1)(ii), this justification will be provided along with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR RFO deviation 5.301, 16.507- 6(f), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. As the fielded assets reach end of life, VA will replace them against brand-neutral performance requirements rather than brand-name specification, and those replacements will be competed.

8. Market Research: To inform the requirement, the Government issued Request for Information (RFI) 36C10B26Q0474 on SAM.gov and through the NASA SEWP V GWAC Market Research Tool and received 22 responses, of which 10 were Service- Disabled Veteran Owned Small Businesses (SDVOSB) and 9 were assessed as capable by the technical team. The market research established that no respondent demonstrated in-house, validated FIPS 140-3 Level 3 HSM operations combined with applied PQC work, and that the consistent market structure is the OEM, Thales TCT, or an OEM-authorized managed- services provider paired with a cleared integrator. The market research further established that the FIPS 140-3 cryptographic module, OEM-authorized Luna engineering, and validated post quantum firmware resides with the platform OEM or its authorized resellers. Thales TCT products and support are carried on SEWP V by multiple SDVOSB contract holders, the items covered by this justification remain available through the authorized reseller channel.

For the brand-name portion specifically, the Government examined whether any other manufacturer could furnish maintenance entitlements, firmware, or partition licensing for the fielded appliances. The Government reviewed the other producers of FIPS 140-3 Level 3 validated hardware security modules, including Entrust, Utimaco, and Eviden, together with the cloud-hosted HSM services offered by Amazon Web Services, Microsoft Azure, and Google. None of them can issue a support entitlement, supply firmware, or issue partition licensing against a Thales TCT appliance, and each would require VA to replace the fielded platform outright before the end of the current products lifecycle.

9. Other Facts: None

Technical/Requirements Certification I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date

VA Office of Information Technology, Infrastructure Operations

Fair and Reasonable Cost Determination I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on expected price competition and comparison with competitive price lists.

Contracting Officer

Contracting Officer Certification/Approval I certify that this justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer

8/25/26