P03 Justification VPNaaS Prisma- final _Redacted.pdf

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 1701 Director’s Blvd.

Austin, TX 78744

2. Description of Action: The proposed action is for a Firm-Fixed-Price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for brand name Palo Alto PRISMA Network as a Service licenses.

3. Description of the Supplies or Services: VA, Office of Information and Technology (OI&T), Information Technology Operations and Services (ITOPS), Solution Delivery (SD) Security Engineering has a requirement for the procurement of 100,000 brand name Palo Alto PRISMA Network as a Service licenses in order to have flexibility of growth capabilities for expansion of telework due to COVID-19. While VA's principal role is serving the health needs of military Veterans and the dependents of Veterans, in accordance with the Agency’s directive and contingency operations plan, the Agency must also be prepared when directed to treat civilians in the event of a crisis.

This is called VA's "fourth mission." As cases of COVID-19, the disease caused by the new coronavirus continue to grow, the option will ensure VA has an adequate coverage to continue to support the surge of remote staff as necessary. This solution will bolster remote access capability by offering an on-demand service that’s readily available for VA use. This flexibility gives the VA the ability to dynamically scale its remote access capabilities as needed while still proving the security visibility required. The Palo Alto PRISMA Network as a Service solution consists entirely of the PRISMA access cloud that will retain existing VA security capabilities and integrate with existing TIC Gateway hardware. The PRISMA Access uses a Service Connection to connect the Prisma Access Service to the VA Network. The Network as a Service capability supports PIV authentication, Client posture validation, and provides routing to the appropriate resources based upon destination. The TIC 3.0 proposed architecture provides capabilities for all destined Internet traffic to route to the PRISMA access cloud and permits management by VA TIC support with the integration of the services. All other destined traffic will reside within the existing VA TIC flow for retention of existing security capabilities. Prisma Access is delivered as a cloud service on top of the PanOS platform, which is capable of inspecting traffic on all ports and protocols. The service provides security capabilities such as SSL decryption, Advanced Threat Prevention, DNS Sandboxing, DLP, and Zero Trust Network Access (ZTNA). The period of performance for the initial procurement of 100,000 brand name Palo Alto PRISMA Network as a Service licenses will be for 12 months from date of award. In addition, VA requires an option period for the purchase of an additional 100,000 brand name Palo Alto PRISMA Network as a Service licenses to provide continued support remote work initiatives due to the COVID-19 pandemic as necessary.

PRISMA VPNaaS, Justification for an Exception to Fair Opportunity

FORCE Number: VA-20-00052950

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart

16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on extensive market research detailed in paragraph 8, VA requires brand name Palo Alto PRISMA Network as a Service. Only the Palo Alto brand or a reseller can meet VA’s requirements. Specifically, only the Palo Alto brand offers a Network as a Service client remote access solution capable of terminating a Transport Layer Security (TLS) or Internet Protocol Security (IPSec) tunnel between VA GFE client and dedicated VA instance within a vendor managed cloud environment. VA requires these capabilities to ensure full end to end encryption of data in transit between VA GFE client and a secure public cloud termination point.

Additionally, the solution must leverage a public cloud that allows for a dedicated customer cloud instance to route traffic to VA via IPSec encrypted tunnels. A dedicated cloud instance is required because VA cannot comingle VA data with other customers. This solution must allow for the advertisement of VA specific routes to the dedicated cloud instance. In addition, the solution must offer the capability to route traffic destined to the general internet through a full threat prevention suite as well as offer a fully integrated PIV authentication and client posture validation service. The VA requires these capabilities in order to properly send data where it needs to go. For example, if a VA employee or contractor is using a benefits application hosted within the VA network, traffic must be sent accordingly in order for the application to work. Likewise, if a VA employee or contactor is using a resource hosted on the Internet, traffic must be sent accordingly in order for the application to work.

Brand name Palo Alto PRISMA Network as a Service is a Secure Access Service Edge (SASE) solution that will securely connect VA users to VA applications and services as well as the Internet. Prisma Access is delivered as a cloud service on top of the PanOS platform, which is capable of inspecting traffic on all ports and protocols. The service provides security capabilities such as SSL decryption, Advanced Threat Prevention, DNS Sandboxing, DLP, and Zero Trust Network Access (ZTNA) and integrates with the VA’s existing Palo Alto Networks on-premises firewall deployment to deploy the VA’s existing firewall policies to this new cloud service.

Due to the COVID-19 health crisis, VA requires the capability to dynamically increase client remote access capability without deploying new additional on premises hardware. Only the brand name Palo Alto PRISMA Network as a Service solution can meet VA’s functional requirement. Without this capability, VA will not have the ability to dynamically expand client remote access services as needed during the COVID-19 pandemic which could lead to inability to provide services and care to the Veteran and non-Veteran populations.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section Eight of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Palo Alto services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: VA Government technical experts conducted market research in April 2020 by reviewing similar Network as a Service products to ascertain if other brands could meet VA’s functionality requirements. Capabilities offered by Zscaler (ZPI (Internet access service) and ZPA (zero trust VPN solution)) do not offer the capability to: terminate a TLS or IPSec tunnel between VA GFE client and dedicated VA instance within a vendor managed cloud environment as well as configure a vendor offered dedicated cloud instance to route traffic to VA via IPSec encrypted tunnels, allow for the advertisement of VA specific routes to the dedicated cloud instance. Solutions by Cisco do not offer a Network as a Service client remote access solution capable of terminating a TLS or IPSec tunnel between VA GFE client and dedicated VA instance within a vendor managed cloud environment.

The Contract Specialist conducted market research in April 2020 through NASA SEWP market research tool. Market research through NASA SEWP showed that there were multiple Service-Disabled Veteran Owned Small Businesses (SDVOSB) capable of providing Brand Name Palo Alto PRISMA Network as a Service. Based on the market research a Request for Quotation for the requirement will be issued to NASA SEWP Group B2 SDVOSB

9. N/A

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this action will be fair and reasonable because NASA SEWP V GWAC prices have previously been determined fair and reasonable.

Additionally, the successful quote will be compared to the published price lists on the NASA SEWP V GWAC price catalog of the successful offeror. Finally, the successful quote will be compared with the Independent Government Cost Estimate.

Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for the Palo Alto PRISMA Network as a Service licenses on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Signature: