P03JA Imperva FinalRedacted.pdf

Imperva Web Application Firewalls VA-21-00070900

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 1701 Directors Blvd.

Austin, Tx. 78744

2. Description of Action: The proposed action is for a firm-fixed-price delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for two brand name Imperva physical appliance Web Application Firewall (WAF) devices and associated software, subscription licenses, Client Reputation Services, and maintenance services.

3. Description of Supplies or Services: The Department of Veterans Affairs, Office of Information and Technology (OIT), Development Security Operations (DEVSECOPS), Infrastructure Operations (IO) requires an expansion of the existing Imperva WAF production environment. VA requires additional network security capabilities needed to monitor, inspect, and protect networks and systems in the data center and the enterprise from the oversubscription of network traffic related to COVID-19 activities.

Additional network security is needed because of both the increase of personnel working remotely due to COVID-19 and several of VA’s technology traffic patterns which have permanently changed. VA requires system security monitoring of all system logs and network connectivity to provide event and log correlation, event alerting and information security threat intelligence, and reporting of all web application activity, which use a web application firewall for data center systems and networks. Specifically, VA requires two brand name Imperva physical appliance WAF devices and associated software, subscription licenses, Client Reputation Services, and maintenance services.

The WAF software includes license upgrades identified in X10K2 WAF Annual Select Support model number SS- WAF-X10K2-SL3 needed to obtain improved functionality.

Additionally, VA requires subscription/maintenance services to begin once the Imperva WAF appliances and associated software components are accepted. The required subscription and maintenance services include 24/7 telephone and email support, software updates, patches, and defect support for one year. Client Reputation Services employs threat intelligence research in data and application security to filter traffic based on real-time reputation of source, adds unique threat intelligence, and detects botnet clients and application DDoS attacks. The Imperva WAF appliances will be delivered within 30 days after award. The maintenance period shall be 12-months from VA’s acceptance of the Imperva WAF appliances. The total period of performance includes one 12-month base period and two 12-month option periods. All appliance devices and associated software will be procured in the base period only. Option periods are for continued subscription, maintenance, and Client Reputation Services.

The total estimated value of the proposed action is inclusive of all option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the spell out supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this justification, it was determined limited competition is available among authorized resellers for brand name Imperva WAF appliance devices and associated software, subscriptions, Client Reputation Services, and maintenance services. The new Imperva WAF appliances and software licenses are the only brand appliances and software which are interoperable with the existing IO WAF and Security Information and Event Management (SIEM) architecture currently in use at the IO data centers. The software code in the existing IO WAF and SIEM infrastructure is proprietary and therefore cannot be provided by any vendor other than Imperva or an authorized reseller. AITC and PITC Security Monitoring Center centrally manages IT security operations of all IO data centers, and they must use the same architecture from the same centralized Security Monitoring Center console. VA has a significant investment in its security operations architecture and anticipates use of the existing IO WAF architecture for a minimum of four years. VA requires hardware, associated software subscription, and maintenance services compatible with the existing infrastructure, protocols, and functionality for continued operational availability. If any other brand name appliances were to be introduced, VA would require extensive redevelopment efforts to replace the current WAF and SIEM architecture. Replacement of the aforementioned IO infrastructure cost would be an estimated $20 million in equipment and training costs and would require an estimated three years to transition to the new platform. This estimate is based off of the original implementation project for security infrastructure across data centers. Without the aforementioned proprietary source code, no source other than Imperva and its authorized resellers can meet VA’s needs. Maintenance and Client Reputation Services are required to ensure the Imperva appliances in operation at IO remain up to date. No vendor, other than Imperva or an authorized reseller, has access to the proprietary software code necessary to provide these services. Should the brand name Imperva physical WAF appliance devices and associated software, subscriptions, Client Reputation and maintenance services for the Imperva systems not be acquired, there is an immediate risk to IO’s network security posture; such as the inability to protect Veteran’s data from all traffic flow that may be malicious in nature.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Imperva products and services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized and justification will be made publicly available on the Contract Opportunities website within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Government technical experts conducted market research from September 2020 to March 2021. The Government’s technical experts reviewed similar hardware, software, and maintenance support products and services including those from alternative vendors such as to ascertain if these items could meet VA’s requirements. Although other vendors possess similar capabilities to provide the required hardware, software, and maintenance support, only Imperva or an authorized reseller has access to the proprietary source code, existing proprietary protocols, and hardware application programming interfaces necessary to provide compatible hardware, subscription licenses, and maintenance required for the particular appliances due to interconnectivity with existing VA infrastructure. As a result of the market research the technical experts confirmed the support and maintenance required can only be procured through Imperva or an authorized reseller. No other firm has the capability of providing the support or maintenance coverage for the Imperva appliances necessary to support existing IO requirements. Additionally, none of the other hardware and software products can meet VA’s interoperability and compatibility requirements as detailed in Section 5 of this justification.

9. Other Facts: None nder to the

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for two brand name Imperva physical appliance Web Application Firewall devices and associated software, subscription licenses, Client Reputation Services, and maintenance services. on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.