PAS JA_Final Signed redacted.pdf

VA-23-00024095

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action:

The proposed action is for a Firm-Fixed Price (FFP) Task Order (TO) that will be issued under the Transformation Twenty-One Total Technology Next Generation (T4NG) Indefinite Delivery Indefinite Quantity (IDIQ) Contract Number 36C10B21D1031 with Decisive Point Consulting Group LLC (DPCG) to provide Privileged Access Security (PAS) Solution Support.

3. Description of the Supplies or Services:

The proposed action is to provide support for the VA, Office of Information & Technology (OIT), Infrastructure Operations Cybersecurity Management (ICSM) for VA’s PAS solution. Infrastructure Operations (IO) is defining requirements, developing, isolating, testing VA’s Privileged Access Security (PAS) solution password vaulting tool, which will allow VA to continue managing over 15,000 privileged users who access the network. PAS includes a robust enterprise password vaulting (EPV) tool suite recommended by the Department of Homeland Security (DHS), which will provide a centralized management of non-individually identifiable accounts and privileged accounts and will help minimize material weaknesses and remediate audit findings as part of VA’s National Recommendations and Findings (NFRs) 4 and 7. These audit findings include, but are not limited to, managing service accounts, improving privileged access monitoring, recording, and enhancing VA’s least privileged policies. VA is also working to continue implementation and compliance with the DHS Continuous Diagnostics and Mitigation (CDM) program for the Privileged Access Management (PRIVMGMT), Request For Service (RFS) 022. RFS-022 focuses on who has privileged access to information technology (IT) resources in the VA. Contractor support services are required to maintain and enhance the PAS solution tool suite of software and its current implementation in the VA operating environments. VA’s PAS solution also includes a CyberArk Privileged Access Management (PAM) Solution to help secure, control, manage and monitor privileged access to the VA’s end points including but not limited critical and high value assets (HVAs). The PAM solution is currently taking the credentials of privileged accounts – i.e., the admin accounts – and placing them inside a secure repository isolating the use of privileged accounts to reduce the risk of those credentials being compromised.

This effort shall provide continuous monitoring, maintenance, and support for the VA’s PAS solution. The scope of work shall include continuous support of VA’s PAS solution;

creation and maintenance of connections with the VA’s target systems/accounts;

conducting required training sessions; identification and onboarding target systems/accounts in the Production, Pre-Production, Quality Assurance (QA), and

Privileged Access Security (PAS) Solution Support VA-23-00024095

Test/Development environments; establishment and maintenance of connectivity from PAS solution to target systems for session management; continuous testing of the PAS solution authentication and authorization; providing ongoing monitoring, maintenance, and development of PAS solution Production and Test/Development environments;

providing Tier 2 and 3 support for Production and Test/Development environment issues; and providing training for Tier 1 personnel. This action is for services only. No software or hardware will be procured or renewed via this action. The Period of Performance (PoP) shall be one 12-month base period, with two 12-month option periods and one 60-day optional task for transition services. The total estimated value of the proposed action is $4,254,889.90, inclusive of all option periods and one optional task.

4. Statutory Authority:

The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C.

4106(c)(4) as implemented by the Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(D), entitled “It is necessary to place an order to satisfy a minimum guarantee.”

5. Rationale Supporting Use of Authority Cited Above:

The proposed source is DPCG, 9200 Hampton Hunt Dr., Fairfax Station, VA 22039.

Solicitation 36C10B19R0046 was issued by VA, Technology Acquisition Center (TAC) on November 12, 2019, soliciting offers pursuant to the On-Ramp Clause of the T4NG contract. On February 25, 2021, nine offerors were chosen for an award in accordance with the criteria set forth in the Basis for Award of the solicitation. Due to four post award protests filed with the US Court of Federal Claims (COFC) by unsuccessful offerors, VA agreed to a voluntary stay of performance and orders could not be awarded to any of the nine On-Ramp awardees until COFC rendered its decisions on the protests. On March 1, 2022, COFC rendered its decisions denying each of the four protests. Due to the aforementioned litigation delays, the original contract effective date of February 25, 2021, had to be modified to reflect a date following the COFC decisions.

Subsequently, modifications were executed on each of the nine On-Ramp contracts to re-establish the contract effective dates to March 21, 2022. Included in the solicitation was FAR clause 52.216-22, Indefinite Quantity, which stated the minimum guarantee that would be satisfied for each resultant contract award under the T4NG contract. This order is being issued to DPCG to satisfy the minimum guarantee. DPCG has been determined by the Government’s technical experts to meet all aforementioned PAS Support requirements. The determination included a review of the selected awardee’s technical capabilities.

In addition to the 12-month base period, the procurement shall include two 12-month option periods, and one 60-day optional task for transition support. PAS Support will require knowledge and expertise of a large area of technologies so a vast array of privileged accesses can be tested over a large environment, maintenance of 130 servers across the VA enterprise; onboarding 15,000 privileged users and 100K + local and domain service accounts; and resolving 130 use cases to ensure privileged users maintain their privileged access as well as identifying areas that may require enhanced remediation not available within current interfaces. Some of the 130 use cases will require writing scripts to create connectors and manage passwords.

Onboarding and managing service account passwords require coordination and scripting to ensure the passwords are updated and the application remains operational.

VA anticipates system and document refinement, to include updates, reviews, edits, and approvals, to continue for two twelve-month periods.

Although the minimum guaranteed value under the T4NG On-ramp contract is $250,000, pursuant to FAR 16.505(b)(2)(i)(D), the Government reserves the right to award initial orders on a sole source basis at amounts which may exceed the minimum guaranteed value.

A minimum guaranteed order under an IDIQ contract must be placed during the same fiscal year as the IDIQ is awarded to avoid a bona fide need violation (31 U.S.C.

Sections 1501, 1502) and until it is placed, there is no enforceable contract. Once the IDIQ contract has been awarded, an obligation is created.

6. Efforts to Obtain Competition:

In accordance with FAR 5.301 and 16.502(b)(2)(ii)(D), this action will be synopsized at award on the Contract Opportunities website and the justification will be made publicly available within 14 days after the award. In addition, this justification will be posted with the solicitation to notify all the T4NG vendors.

7. Actions to Increase Competition:

There is no competition anticipated for this action as it is being issued to meet the mandatory minimum guaranteed value for this IDIQ contract. It is expected that any future requirements will be awarded on a competitive basis.

8. Market Research:

VA attempted to satisfy minimum guarantees by competitively awarding requirements under the T4NG vehicle through Fiscal Year 2022. However, not all minimum guarantees were met as a result of the competitive process. Specifically, at this time, DPCG still requires a minimum guarantee TO be awarded under the T4NG vehicle. This fact was brought to the attention of the technical team to determine whether or not the PAS Support requirement could be utilized to award DPCG its minimum guarantee on T4NG. In order to determine if DPCG would be interested in, and capable of, performing the PAS Support requirements, the Contracting Office provided DPCG a draft copy of the Performance Work Statement on December 16, 2023. On January 03, 2023 DPCG submitted a capability statement. After reviewing the capability statement provided, the Government technical experts determined that DPCG would be capable of performing the PAS Support requirements. Therefore, to avoid potential ADA implications, the Government will proceed with a sole-source minimum guarantee award under the T4NG contract to DPCG.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

James Medlock Date: ________________________________

Program Manager Signature: ____________________________

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on price analysis and comparison with the Independent Government Cost Estimate.

Dana Newcomb Date: ________________________________

Procuring Contracting Officer Signature: ____________________________

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Dana Newcomb Date: ________________________________

Procuring Contracting Officer Signature: ____________________________

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of PAS Solution Support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.

Date: ____________ Signature: _________________________________ Philip Weckesser Advocate for Competition Technology Acquisition Center

Office of Procurement, Acquisition, and Logistics