P03_Redacted JA - Imperva. Final.pdf

VA-20-00045285 Imperva Software Maintenance and Support.

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown , NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-wide Acquisition Contract (GWAC) for the renewal of Imperva software maintenance and support.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Information Technology Operations and Services (ITOPS), Infrastructure Operations (IO), has a requirement to renew brand name Imperva software maintenance and support for existing Imperva products currently in use at Austin Information Technology Center, Philadelphia Information Technology Center, and Hines Information Technology Center. The brand name Imperva software maintenance shall consist of firmware upgrades and updates to include major releases, point releases, service releases and security releases of applicable firmware on a quarterly basis, and/or within 48 hours in cases where a high-risk vulnerability fix becomes available. Additionally, software maintenance will also provide technical support via telephone, e-mail, or internet to troubleshoot malfunctioning software that restores full operation and accessibility to the original redundant configuration. Additionally, support shall include a Designated Support Engineer (DSE) which shall act as a single point of contact for all support issues. The DSE will provide expedited case handling and escalation as needed. The DSE will also provide proactive support, maintenance, tuning and optimization of SecureSphere, an Imperva product VA utilizes for database security. The DSE will host weekly status calls for a maximum of three customer accounts with services and support capped at 15 hours per week. The Contractor shall provide one telephone number for VA to contact and open a maintenance support call. The Contractor shall provide support services 24 x 7 x 4 x 365 (Hours per Day x Days per Week x Hours per initial call x Days per Year).

All VA support calls shall be initiated by the VA designated point of contact. When applicable, the Contractor shall provide secure connection capabilities for the downloading of software updates and/or the uploading of diagnostic information. The preferred protocol for transfer is Secure File Transfer Protocol. The period of performance will be September 1, 2020 through August 31, 2021, with two 12 month option periods, if exercised. The total estimated price of the proposed action, inclusive of options, is $ XX.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B) entitled, “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is viable among resellers for brand name Imperva software maintenance and support.

The current IO infrastructure is based on existing Imperva software and VA requires support compatible with the existing infrastructure, protocols, and functionality for continued operational availability. The support will provide all current and future patches, upgrades, security vulnerability remediation, diagnosis and troubleshooting support, and configuration guidance to systems of Imperva. Only Imperva or an authorized reseller can provide the necessary software support on the software that is inherent to hardware within the existing VA-owned Imperva environment because of the proprietary source code required to develop and implement software upgrades, firmware and updates. For this reason, any other brand name software VA would purchase would require a complete redesign, reengineering, and redevelopment of the existing infrastructure. During any replacement of software VA would have to conintue running the Imperva software in addition to the new software which would result in duplication of efforts running two different brand names over a three year plus period for full implementation and would cost approximately $XX. This estimate is based off of the original implementation project to standardize security infrastructure across data centers. Without the aforementioned proprietary source code, no source other than Imperva and its authorized resellers can meet VA’s needs. System support is required to ensure the Imperva appliances in operation at IO remain up-to-date. Should support for the Imperva systems not be acquired, there is an immediate risk to IO’s network security posture. Gaps would exist within the software, thus not allowing full security visibility of the database and web application vulnerabilities on the network.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, limited competition is viable among resellers for brand name Imperva software maintenance and support on the NASA SEWP V GWAC. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award resulting from this action will be synopsized and justification will be made publicly available on the Contract Opportunities website within 14 days of award.

7. Actions to Increase Competition: The Government will continually conduct market research by surveying the marketplace to determine if there are any other solutions that can meet VA’s needs.

8. Market Research: Imperva software maintenance and support is a commercially available off-the-shelf maintenance package currently in use in VA. The Government’s technical experts conducted market research in January 2020, by reviewing similar maintenace products including International Business Machines, AMP Tech Solutions and AppSecurity to ascertain if these items could meet VA’s requirements. Although other vendors possess similar capabilities to provide the required support and maintenance, only Imperva or one of it’s resellers has access to the proprietary source code, existing proprietary protocols, and software application programming interfaces specific to the support and maintenance required to support existing IO requirements and none of the other products could meet VA’s interoperability and compatibility requirements as outlined in Section 5 of this justification.

Additional market research was conducted by the Government in April 2020 to ascertain the extent of limited competition among resellers of the required Imperva software maintenance and support, wherein the Contract Specialist utilized the Provider Lookup tool on the NASA SEWP website. The research shows that there are a total of 14 Service-Disabled Veteran Owned Small Business contract holders identified as resellers of brand name Imperva that can fulfil the Government’s requirements.

9. Other Facts: None