P03 Justification for an exception to fair opportunity_CO dw w comments resolved 2_Redacted.pdf

Verizon Public Key Infrastructure (PKI) Shared Service Provider (SSP) Control Number: VA-21-00021043

LIMITED-SOURCES JUSTIFICATION

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 1701 Directors Blvd, Suite 600 Austin, TX 78744

2. Description of Action: The proposed action is for a 12-month firm-fixed price delivery order with an option for an additional 12-month period for Verizon Public Key Infrastructure (PKI) Shared Service Provider (SSP) services, recovery and revocation services, and associated technical support services, to include one 12-month option period. This effort is being conducted under the authority of the Multiple Award Schedule Program; the proposed effort will be awarded under the General Services Administration (GSA) Federal Supply Schedule (FSS) Information Technology (IT) 70 contract number GS-35F-0382T to MCI Communications Services, Inc., doing business as Verizon Business Services (Verizon), 22001 Loudon County Parkway, Ashburn, VA 20147.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Service Delivery and Engineering (SDE), Enterprise Systems Engineering (ESE), Enterprise Messaging and Collaboration Services has a requirement for full spectrum PKI SSP services, which includes configuration, certificate validation, and software certificate registration of the existing VA Personal Identity Verification (PIV) Card Management System. The PKI SSP services shall include issuance, revocation, renewal, and recovery of digital certificates and keys for VA end-entities (cardholders); however, these services will not increase the existing infrastructure which currently consists of 500,000 seat licenses, with each seat including up to four certificates. PKI SSP services are required to meet the technical specifications and requirements for compliance with Homeland Security Presidential Directive 12 and Federal Information Processing Standard 201-1. VA also requires a recovery capability for all existing escrowed PKI encryption keys previously issued by Verizon under prior contracts and a source to provide revocation for any certification that has been issued that is currently active. Additionally, VA requires standard Verizon technical support of the recovery and revocation solutions. The period of performance shall include a 12-month base period with one 12-month option period.

The total estimated value of the proposed action is inclusive of the option period.

4. Authority: This acquisition is conducted under the authority of the Multiple-Award Schedule Program. The specific authority providing for a limited source award is Federal Acquisition Regulation (FAR) Part 8.405-6(a)(1)(i)(B), “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.”

Verizon Business PKI Cert Solution w/Cert Recovery Control Number: VA-21-00021043

5. Rationale Supporting Use of Authority Cited Above: The proposed source is MCI Communications Services, Inc., doing business as Verizon. Based on market research, as described in section 8 of this justification, it was determined that there is no competition, as Verizon is the proprietary owner and only authorized vendor that can provide the required full spectrum PKI SSP services, recovery and revocation services, and associated technical support services. VA requires the ability to issue, revocate, and recover PKI encryption keys in order to maintain access to key material that allows for the decryption of email. This process is required by the policies under which the certificates were issued, and supports users’ access to legacy data. There are also numerous legal and law enforcement initiatives that require VA to maintain access to the escrowed key material for seven to ten years. The use of any other vendor, or a break in service with Verizon would render VA unable to issue and recover previously issued encrypted certificates and would not meet the Government’s PKI requirements .

Verizon is the current contract holder for PKI SSP services with VA under Contract GS- 35F-0382T, Delivery Order 36C10B19F0096, which has a period of performance that will end on February 9, 2021. Under this order, Verizon issues PKI encryption certificates to VA employees and partners, as well as provides revocation and recovery support. Delivery Order 36C10B19F0096 supports 500,000 seats with each seat including up to four certificates each. The services to be acquired under the new action will continue to support the 500,000 seats and corresponding certificates. In addition, Verizon is the current host and operator of VA’s PKI certificate authority. Verizon holds PKI encryption certificate key pairs in escrow storage, on VA’s behalf, in accordance with 509 Certificate Policy, for the U.S. Federal PKI Common Policy Framework. Hence, when a PKI encryption key is created, Verizon issues the key pair to the user, and stores a copy of the private key in a separate data store under its control. The escrow storage is unique and specific to Verizon. Other vendors do not have access to the data and data cannot be transitioned to another provider due to the requirement to maintain PKI certificate trust relationships within the existing Verizon certificate issuing authority.

VA does not possess the ability to retain encryption keys due to the fact that only Verizon retains the proprietary rights to the PKI certificates they issue. Only Verizon’s hosting certificate authority software can provide the required decryption capability and compatibility with encrypted certificates and keys issued to VA employees and contractors. Therefore, only Verizon can provide the required PKI certificate recovery and revocation services, since only Verizon has access to the proprietary data and enterprise databases supporting automated PKI certificate issuance and administration functions for VA. Verizon is the sole provider capable of operating the current proprietary certificate authority system and process that maintains and controls all VA PKI issued by Verizon. No source other than Verizon can host the complete PKI currently used to issue, recover, or revoke certificates it issues. Verizon is the only source capable of operating the current PKI and publishing the verification information for credentials to recover or revoke certificate key pairs from the current system.

Furthermore, no other source can provide the aforementioned technical support services since the source code for the certificate recovery system is proprietary.

The current delivery order ends on February 9, 2021 and a break in service would immediately invalidate VA secure email PKI certificates provisioned on PIV cards issued to employees and contractors, thereby eliminating the ability to access critical VA systems to perform their duties, severely disrupting delivery of healthcare and benefits to Veterans. VA is currently in the process of transitioning from PKI services provided by Verizon to services provided by the Department of Treasury (Treasury). On August 30, 2013, VA established an Interagency Agreement (IA) with Treasury for enterprise-wide PKI certification, as current PKI contracts do not meet VA’s overarching needs.

However, in order for VA to utilize services available on the IA, completion of technical migration is required. Migration of PKI services is a complex task requiring coordination among VA, Verizon, and Treasury. VA’s migration to Treasury is approximately 15% completed and with all migration efforts anticipated to be completed by December 2022.

Once this technical migration is complete, Treasury will leverage an existing contract to indirectly obtain, via Verizon in its capacity as a subcontractor, access to the proprietary information necessary to provide the required PKI services. Therefore, there is still a need for continuation of Verizon PKI certificate issuance, recovery, and revocation services. Accordingly, this proposed action allows for a 12-month base period and 12-month option period to continue the current services provided by Verizon until VA can complete the PKI SSP services migration to Treasury.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. There is no competition anticipated for this acquisition. In accordance with FAR Part 8.405-6(a)(2) and FAR Part 5.301, a copy of this Limited-Sources Justification will be posted, along with a synopsis constituting notice of award of the resulting delivery order, to the Contract Opportunities Page website on beta.SAM.gov website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: VA does not anticipate any future need for continuation of Verizon PKI SSP services, recovery, and revocation services, and associated technical support services once technical migration of PKI services to the Treasury is complete, which is currently anticipated by the end of calendar year 2022.

8. Market Research: Market Research was conducted in October 2020 by VA PKI Subject Matter Experts that queried GSA Schedule 70 product catalogs and National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contracts for companies to fulfill VA PKI needs. While multiple companies, to include VeriSign and Operational Research Consultants, Inc., are certified to issue new PKI certificates under all existing guidelines, none have the capability to operate the current PKI infrastructure supporting VA. VA requires the ability to issue, revocate, and recover PKI encryption keys in order to maintain access to key material that allows for the decryption of email. There are numerous legal and law enforcement initiatives that require VA to maintain access to the escrowed key material for seven to ten years. A break in service would render VA unable to issue and recover previously issued encrypted certificates and would not meet the PKI requirements. Verizon is the only source capable of operating the current infrastructure, publishing the certificate verification information for credentials, and conducting maintenance of all previously issued certificates, since Verizon retains the proprietary rights to the PKI certificates issued. No other vendor has the capability of recovering PKI encryption keys issued by Verizon. Additionally, only Verizon can access the proprietary source code in order to provide the required technical support, in addition to all software updates. In October 2020, VA contacted Verizon to ascertain if its proprietary data was for sale. Verizon advised that this data is not for sale. All PKI certificates previously issued by Verizon to VA employees and contractors can only be revoked and recovered using Verizon’s current certificate authority. Therefore, a new delivery order with Verizon is required to maintain VA’s ability to issue, revocate, and recover PKI encryption certificates and keys. Based on the market research, it was determined that only Verizon can meet all the Government’s requirements

9. Other Facts: None

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Determination of Best Value: I hereby determine that the proposed contract action will represent the best value to the Government consistent with FAR 8.404(d). GSA has already determined that the prices on the FSS contract are fair and reasonable. Further price analysis, to include an analysis of proposed level of effort and mix of labor, will be conducted and subsequent negotiations held as necessary. Additionally, price discounts will be sought.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Verizon Business PKI services, recovery and revocation services, and associated technical support services on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.