Redacted JA Encase.pdf

Control Number VA-21-00028569

JUSTIFICATION AND APPROVAL

FOR EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs Office of Acquisition Operations

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for renewal of brand name OpenText Inc. EnCase Endpoint Investigator annual license maintenance and technical support.

3. Description of Supplies or Services: The proposed action is to provide the Department of Veterans Affairs (VA) Office of Information & Technology (OIT) with renewal of brand name OpenText Inc. EnCase Endpoint Investigator software and maintenance and technical support currently deployed to over 500k endpoints. This software helps the VA investigate, chnology (IT) network by enabling the VA to respond to security incidents, proactively investigate issues of fraud, conduct forensics investigations, and perform network and software audits. EnCase licensing is subscription based and needs to be renewed annually in order to use the software deployed. This also provides maintenance consisting of software upgrades, patches, fixes, updates as well as technical support Monday through Friday 9AM to 5PM Eastern Standard Time. The period of performance shall be a 12-month base period, with two 12-month option periods. The total estimated value of the proposed action is $XXXXXXX.

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition the supplies or services required at the level of quality required because the supplies or servic

5. Rationale Supporting Use of Authority Cited Above:

Based on market research, as described in Section 8 of this document, it has been determined that limited competition is available for this procurement. The current VA Cyber Security Operating Center (CSOC) forensic endpoint investigator infrastructure is based on EnCase software. EnCase software is deployed and configured to VA endpoints In order to continue utilizing existing forensic capabilities, VA requires continued licencing, support, and maintenance to ensure that the software functions properly, and ensures software upgrades are received so the software is capable of resolving the most current security vulnerabilities. No other software is configured and deployed with the 500,000 VA endpoints being monitored, and no other software could immediately be deployed to this infrastructure without significant reconfiguration, integration, and ultimately disruption.

Further, no other maintenance services have access to the EnCase proprietary source code, and therefore could not provide software upgrades, patches, or bug fixes to ensure the software is up to date and functioning. If this maintenance and continued licensure is not provided, VA risks loss of its cyberforensics capability in over 500,000 endpoints thereby impacting VA incident response and visibility. This would result in security vulnerabilities and potential loss of data or exposure of Personally Identifiable Information (PII) and Protected Health Information (PHI). Furthermore, it impacts the Office of Inspector General (OIG) as they also rely on EnCase for their investigations, allowing for simplicity of use and common data.

licensing support and maintenance would require completely new alternative forensic infrastructure solutions including new security software to be purchased enterprise wide and configured to the VA system. This would cause a duplication in costs as new software licenses would have to be purchased integrated, configured, and implemented in the VA infrastructure costing at least $3,300,000. This estimate is based on previous acquisition history for the procurement of the software and configuration required. This would also result in a break in services of at least nine months as the new licenses are reconfigured infrastructure which is a significant undertaking requiring substantial resources and time. This break in service risks exposing Veteran data to security breach. This break in service would have a damaging effect on the existing VA EnCase forensic infrastructure. And

Losing its remote forensics capability would result in disruptions in its internal operating system forensic software compatibility and interoperability which would make VA networks prone to malicious attacks, risk the integrity of VA processes like claims processing, and risk Veteran and personal information being exposed. This is an unacceptable risk to CSOC in achieving its mission critical information protection

-critical applications concerning patient information.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. Limited competition is anticipated for this acquisition. In accordance with FAR 5.301 and 16.505(b)(2), this action will be synopsized at award on beta.sam.gov Contracting Opportunities site and the justification will be made publicly available.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed.

8. Market Research:

experts in March 2021 by reviewing similar infrastructure solution software from FTK and F-Response. While these products offer similar functionality to EnCase, the VA Technical experts determined that no competing products can meet the interoperability requirements as described in paragraph 5 above. Since the current VA forensic software infrastructure consists solely of EnCase products, any software used to continue operations or expand upon the infrastructure must be capable of integrating with the currently owned EnCase products. Due to proprietary software code owned by OpenText Inc., there is no other product that offers the required functionality of EnCase Endpoint Investigator and can also integrate into the current VA CSOC forensic software infrastructure. Only OpenText EnCase Endpoint Investigator licenses can irements for this effort.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

XXXXXXXXXX Date: ______________________

Manager, VA CSOC Signature: ______________________

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on EnCase Endpoint Investigator Annual Maintenance and Technical support.

XXXXXXXX Date: ______________________

Procuring Contracting Officer Signature: ______________________

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

XXXXXXX Date: ______________________

Procuring Contracting Officer Signature: ______________________

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for the renewal of brand name OpenText Inc. EnCase Endpoint Investigator annual license and maintenance and technical support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: ____________ Signature: _________________________________

XXXXXXXXXXXXX

Advocate for Competition Technology Acquisition Center

Office of Procurement, Acquisition, and Logistics