P03 JnA ForeScout - Redacted.pdf

VA-21-00058643

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs Office of Acquisition and Logistics Technology Acquisition Center 1701 Directors Blvd Austin, TX 78744

2. Description of Action: This proposed action is for a firm-fixed-price (FFP) delivery order (DO) to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) to acquire brand name ForeScout CounterACT devices and hardware maintenance.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information Technology (OIT) Security Development Operations (SecDevOps) Infrastructure Operations (IO) Cybersecurity Management requires 48 brand name ForeScout CounterACT devices to replace existing end-of-life ForeScout devices in production within IO. VA’s Continuous Readiness Information Security Program (CRISP) requires system security monitoring of all system logs and network connectivity to provide event logging and log correlation, event alerting and information security threat intelligence, and reporting of all nongovernment furnished equipment. The VA uses a Security Information and Event Management (SIEM) solution to accomplish this for datacenter systems and networks. Using a combined SIEM ForeScout plug-in data feeds from the ForeScout architecture, collectively referred to as ForeScout appliances and licensing, allows the VA to meet these Network Access Control (NAC) requirements for non-GFE. Finally, VA requires maintenance to begin once the 48 new ForeScout devices are accepted. The required maintenance includes 24/7 telephone and email support and software updates. The period of performance will include a 12 month base period, plus three (3) 12-month option periods. All hardware will be procured in the base period only. The total price of the proposed action is , inclusive of all option periods,.

4. Statutory Authority: The statutory authority permitting this exception to fair opportunity is Federal Acquisition Regulation (FAR) Subpart 16.505(b)(2)(i)(b) entitled, “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: This is a brand name justification in support of FAR 11.105, Items Peculiar to One Manufacturer. ForeScout hardware is the only brand that can continue to build upon EO Security’s existing application and network protection system. Other brand name solutions researched were unable to integrate with the currently fielded IO Cybersecurity Technology ForeScout-based architecture licensing. Specifically, the current ForeScout-based infrastructure, hardware, and ancillary software communicates through a source code

ForeScout Hardware Refresh EO Network Access Control VA-21-00058643 that is based on ForeScout proprietary data. No other brand solution can provide this communication capability without this source code. The ForeScout cybersecurity appliance satisfies the need for agent (software installed) and agentless (no software installed) requirements for all managed or unmanaged mobile devices, device software inventory and use, and identity of suspicious activity on individual devices to correlate with IO’s SIEM to include: machine learning correlation; preemptive vulnerability scanning; virtual remediation of individual devices; and tracking operating and system changes to include device type, configuration and user location, user role and activities, device security state, and whether a device is managed or unmanaged.

This allows IO to quickly understand a user’s security status and be able to take action.

In addition to the VA’s continuous monitoring requirement, these appliances are needed to support the VA’s Information Technology (IT) visibility to the Network initiative, which includes end point discovery and physical access control. This will provide IO a single interactive view that displays the monitored IO’s network’s security posture of all network elements of end point visibility and protection that can only be provided through use of brand name ForeScout. Specifically, the use of any other brand name cannot accomplish this because no other brand product can communicate, nor integrate with the architecture and licensing of the current production ForeScout Enterprise Manager Console and will not allow security visibility of end point vulnerabilities on the network.

Additionally, none of other products can offer the upstream forwarding of localized data into the existing IO console architecture, which is critical in producing a single view collective status of all ForeScout security related activity over the network.

The use of any other brand devices would necessitate the complete replacement of the existing ForeScout infrastructure in place which includes 360 ForeScout CounterACT devices. Such a replacement is estimated to cost a minimum of and would take approximately 2 years to complete. These estimates are based on previous acquisition history. These duplicative costs would not be expected to be recovered through competition. Additionally, only through ForeScout or through its authorized resellers can VA procure the required hardware maintenance for the required ForeScout devices.

Maintenance from any other brand vendor would not have access to the required source code that is based on ForeScout proprietary data necessary to provide maintenance.

If the procurement for the required brand name ForeScout CounterACT devices and hardware maintenance is not completed, the security monitoring of all system logs and network connectivity and the ability for VA to provide event logging and log correlation, event alerting and information security threat intelligence and reporting of all nongovernment furnished equipment would be severely and negatively impacted. VA primarily relies on this ForeScout infrastructure to deliver very specific data requirements for the Department of Homeland Security. The same infrastructure is the first responder infrastructure to cybersecurity comply-to-connect emergent threat protection requirements. Without this procurement, when threats to VA and Veteran information occur, VA’s ability to provide response would be hampered. As such, both Veteran initiatives and offerings would be compromised and would negatively impact the care VA can offer Veterans and their families.

ForeScout Hardware Refresh EO Network Access Control VA-21-00058643

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section eight (8) of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for ForeScout appliances and maintenance. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the SAM.gov website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the agency will work with the program office to continue to perform market research to consider and ascertain if any other sources can provide these services in the future.

8. Market Research: The Government’s technical experts conducted ongoing market research as recently as January 2021 through review of industry trade publications, internet based research, and actual VA experience in production VA requirements to ascertain if any other brand name can meet VA’s requirements. The Government’s technical experts reviewed other similar cybersecurity end point visibility, identification, classification, cybersecurity threat response and asset inventory systems to include similar solutions from Trustwave and Cisco. Based on reviews of these products, the Government’s technical experts determined that none of these products can meet the Government’s interoperability and compatibility requirements nor avoid the duplicative time and cost as outlined in Section 5 of this justification. Additionally, none of these other products can offer the upstream forwarding of localized data into the existing IO console architecture, which is critical in producing a single view collective status of all ForeScout security related activity over the network. Based on all of these market research efforts, the Government’s technical experts have determined that only the ForeScout brand name security appliance and hardware maintenance can meet all of IO data center needs.

Additionally, the Contract Specialist (CS) posted RFI #195558 to NASA SEWP seeking capability statements for any alternative products that opened on May 27, 2021 and closed on June 4, 2021. One response was received in the form of a quote for ForeScout products and maintenance. The CS received no other responses or any o indication there is an alternative product to ForeScout that can meet VA requirements.

9. Other Facts: Additionally, the technical expert utilized the NASA SEWP V GWAC manufacturer lookup tool and determined that there are resellers of the requested ForeScout product.