Redacted JA - Imperva WAF.pdf

Control Number: VA-21-00012943

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for two brand name Imperva physical appliance Web Application Firewalls (WAF), equipped with hardware and software components, cards, threat radar reputation services for WAF, subscriptions and maintenance services.

3. Description of Supplies or Services: VA requires system security monitoring of all system logs and network connectivity to provide event and log correlation, event alerting and information security threat intelligence, and reporting of all web application activity, which use a web application firewall for data center systems and networks. Using combined Security Information and Event Management (SIEM) WAF plug-in data feeds for Imperva and the existing Imperva architecture, collectively referred to as brand name Imperva WAF appliances and software, will meet all of these requirements. The requirements are identified under the Federal Information Security Modernization Act for System Owners. The WAF software includes standard software and licenses; however, license upgrades identified in X10K2 WAF Annual Select Support model number SS- WAF-X10K2-SL3 are needed to obtain improved functionality. Additionally, VA requires subscription/maintenance services to begin once the four new Imperva WAF appliances and associated software components are accepted to upgrade the existing Imperva devices that are now at capacity for the Austin Information Technology Center (AITC) and the Philadelphia Information Technology Center (PITC). The required subscription and maintenance services include 24/7 telephone and email support, software updates, patches and defect support for one year. The Imperva WAF appliances will be delivered within 30 days after award. The maintenance period shall be 12-months from VA’s acceptance of the Imperva WAF appliances, cards and reputation services.

Additionally, there will be three 12-month option periods for continued subscription, maintenance, and reputation services. The total estimated value of the proposed action is $XXX, inclusive of all option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the spell out supplies or services ordered are unique or highly specialized.”

Imperva Web Application Firewalls VA-21-00012943

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this justification, it was determined limited competition is available among authorized resellers for brand name Imperva WAF appliances, subscriptions and maintenance services. The requirement for VA compliance applies to the Infrastructure Operations (IO) architecture in use. The new Imperva WAF appliances and software licenses are the only brand appliances and software which are interoperable with the existing IO WAF and SIEM architecture currently in use at the IO data centers. The software code in the existing IO WAF and SIEM infrastructure is proprietary and therefore cannot be provided by any vendor other than Imperva or an authorized reseller. AITC and PITC Security Monitoring Center centrally manages IT security operations of all IO data centers, and they must use the same architecture from the same centralized Security Monitoring Center console. VA has a significant investment in its security operations architecture and anticipates use of the existing IO WAF architecture for a minimum of four years. VA requires hardware associated software and subscription and maintenance services compatible with the existing infrastructure, protocols, and functionality for continued operational availability. If any other brand name appliances were to be introduced, VA would require extensive redevelopment efforts to expand the current WAF and SIEM architecture. Replacement of the aforementioned IO infrastructure cost would be an estimated $XX in equipment and training costs and would require an estimated three years to transition to the new platform. This estimate is based off of the original implementation project for security infrastructure across data centers. Without the aforementioned proprietary source code, no source other than Imperva and its authorized resellers can meet VA’s needs.

Maintenance is required to ensure the Imperva appliances in operation at IO remain up-to-date. Should the brand name Imperva physical appliance WAF, threat radar reputation services and subscriptions and maintenance services for the Imperva systems not be acquired, there is an immediate risk to IO’s network security posture.

Gaps would exist within the software, thus not allowing full security visibility of the database and web application vulnerabilities on the network.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Imperva products and services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized and justification will be made publicly available on the Contract Opportunities website within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

Imperva Web Application Firewalls VA-21-00012943

8. Market Research: Imperva provides commercially available off-the-shelf appliances, licenses, hardware support and hardware maintenance packages that are currently in use in VA. When conducting market research from March 2020 to September 2020, the Government’s technical experts reviewed similar hardware and maintenance support products including F5, PaloAlto and Trustwave to ascertain if these items could meet VA’s requirements. Although other vendors possess similar capabilities to provide the required hardware and maintenance support, only Imperva or an authorized reseller has access to the proprietary source code, existing proprietary protocols, and hardware application programming interfaces specific to the support and maintenance required for the particular appliances due to interconnectivty with existing VA infrastructure as described in Section 5 above. As a result of the market research the technical experts confirmed the support and maintenance required can only be procured through Imperva or an authorized reseller. No other firm has the capability of providing the support or maintenance coverage for the Imperva appliances necessary to support existing IO requirements. Additionally, none of the other hardware and software products can meet VA’s interoperability and compatibility requirements as detailed in Section 5 of this justification.

Additional market research was conducted in November 2020 by the Contract Specialist utilizing the NASA SEWP Provider Lookup tool to determine whether the brand name Imperva is available from NASA SEWP V GWAC holders. It was determined that there are 14 prospective Service-Disabled Veteran-Owned Small Business GWAC holders in Group B(2) of Imperva products and services. As such, limited competition is anticipated.

9. Other Facts: None