RedHat JA Redacted.pdf

VA Red Hat Enterprise Linux Software Subscriptions and Technical Support

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed priced delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for the renewal of enterprise-wide brand name Red Hat software subscriptions which include software and associated maintenance and technical support, professional services, and training.

3. Description of the Supplies or Services: VA, Office of Information and Technology, Service Delivery and Engineering, Infrastructure Operations, has a requirement for the renewal of 23,282 existing enterprise-wide Red Hat software subscriptions which include renewal of software as well as associated maintenance and technical support that is used throughout VA’s Enterprise Linux Operating Systems (OS). The existing Red Hat software architecture and infrastructure allows VA to monitor the performance of the current computers controlled by the Enterprise Linux OS to ensure reliable operations and provides VA with the capability to satisfy ongoing maintenance, security and operational requirements for existing development, test, validation and production systems executing on Linux-controlled computers. There are approximately 250 different Veteran and dependent pension, financial systems, benefits, health, loan, internal compensation and payment system programs within VA using applications hosted only on Red Hat. Specific examples include Enterprise Veterans Self Service (eBenefits), Benefit Discount Card/Veterans Identification Card, Loan Guaranty and Joint Legacy Viewer (JLV). In addition to these local VA programs, a collaboration between VA and Department of Defense (DoD) exists for HealthShare Enterprise Platform, VA/DoD Identity Repository and Community Care Reimbursement. These applications have already been developed, implemented, tested, validated, certified and awarded the Authority To Operate (ATO) using the VA Assessment and Accreditation process.

In accordance with VA Handbook 6500 and National Institute of Standards and Technology (NIST) Security Technical Implementation Guide, VA requires the software to meet Common Criteria International Organization for Standardization/International Electrotechnical Commission 15408 certification and Federal Information Processing Standards (FIPS) 140-2 certification – from NIST for FIPS 140-2 validation.

The required Red Hat software maintenance shall consist of signed Red Hat source code and binary version upgrades, patches, fixes, updates and security resolutions. All subscriptions and services must be compatible and interoperable with VA’s existing Linux OS infrastructure and meet VA’s OS requirements. The technical support shall provide for Red Hat Technical Account Management, which shall be the focal point for Red Hat Platforms support, consisting of access to Red Hat technical support advisors/specialists during normal business hours. Technical support includes the following: early identification of deployment issues, periodic risk assessments, quarterly reporting of service performance metrics and provides for the analysis, troubleshooting and resolution of any other Red Hat software product-related problems or questions encountered by Government users with the specified software products. Together, the software maintenance and technical support ensures the Red Hat software remains fully operational and is continually updated with signed Red Hat source code, which is the underlying code for Red Hat Enterprise Linux (RHEL), updated software and updated binaries. The software subscriptions consist of: Red Hat Enterprise Learning Subscription Standard (100 Entitlements); Red Hat Directory Server (Replica);

Dedicated Technical Account Management Services for OpenShift; Red Hat Ansible Automation Platform, Premium, Confirmed Stateside Support (100 Managed Nodes);

RHEL Server with Satellite, Premium, Confirmed Stateside Support (Physical or Virtual Nodes), and Red Hat Directory Server, Confirmed Stateside Support.

The required Red Hat professional services consist of Red Hat Enterprise and Solution Senior Architect, Consultants, Education Account Manager, and Cleared Maintenance Engineer Technical Account Manager. These services provide mission-critical enterprise-level support required to maintain, optimize, and modernize the Department’s Red Hat infrastructure. This includes strategic guidance and design support for RHEL, Red Hat OpenShift, Ansible Automation Platform, and associated middleware and container platforms.

This requirement includes 27 Optional Tasks for additional Red Hat software subscriptions applicable to both the Base Period and each subsequent Option Period, in order to support VA’s evolving operational demands across on-premise and cloud environments. These Optional Tasks generally encompass enterprise-level software capabilities and professional services, including but not limited to automation platforms, container orchestration, virtualization solutions, technical account management, advanced support services, lifecycle extensions, Artificial Intelligence enablement, and training resources. VA technical staff must complete regular Red Hat training to maintain proficiency and stay current with evolving features, technologies, and security best practices. These training requirements will be met via Red Hat Learning Subscriptions, which deliver online training, hands-on labs, and certification preparation where required.

The Period of Performance for this effort shall be 12 months from September 29, 2025, through September 28, 2026, with 4 12-month Option Periods and Optional Tasks for additional software subscriptions, maintenance, technical and professional support for each ordering period. Optional Tasks may be exercised at the discretion of the Government at any time during performance of the delivery order for a period of up to 12 months. The overall Period of Performance of the order shall not exceed 60 months.

The total estimated value of the proposed action is , inclusive of all Option Periods and Optional Tasks.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on the market research as described in Section 8 of this justification, it was determined that limited competition is available among resellers for the required Red Hat software subscriptions and associated maintenance and technical support. VA’s existing Linux Server infrastructure is solely based on Red Hat’s Linux OS. Thus, only Red Hat brand name binary software subscriptions, provided by Red Hat or an authorized reseller, are compatible and interoperable with VA’s existing Linux Server infrastructure. Only Red Hat brand name binary software subscriptions can meet all of VA’s requirements, as well as VA’s overarching baseline security requirements.

No other vendor can deliver non-publicly available RHEL software subscriptions that are capable of producing signed Red Hat Linux OS binary updates, patches or trademarks with these OS requirements because only Red Hat or its authorized resellers can obtain signed source software and updates directly from Red Hat. Only Red Hat or an authorized reseller can provide the required, signed Red Hat Linux binary, non-public Red Hat Linux source OS compatibility, immediate Red Hat Linux binary signed patches for severity one bugs, vulnerability updates, major and minor releases and management capability, allowing VA to continue its ongoing Red Hat Linux infrastructure support while also meeting the growing needs within the RHEL infrastructure. Using publicly available Linux source code to support VA’s Red Hat Linux instances with publicly available source code for security updates and patches, would put VA at risk of a material breach of the Red Hat Enterprise Agreement, as other vendors’ only source of software would be the open-source upstream community project, Community Enterprise Operating System (CentOS), or its derivatives, which is a public repository. This results in no other brand name software subscription, including RedHat’s open-source version, being able to meet all of VA's security requirements detailed in Section 3.

Specifically, only the certified version of Red Hat meets VA’s OS requirements for OS versioning control, vulnerability management and data mining protection with respect to NIST Special Publication 800-53. These security measures restrict data obtained from data stores and data that is available as open-source information residing on external sites because that data has the potential for code modification. Using open source RedHat, the chain of custody would be broken, resulting in a non-certified version. VA requires OS certifications that come with signed software binaries, as outlined in VA Handbook 6500. These do not transfer to the upstream CentOS, or its derivatives, public repository. This means any update provided by the open source upstream community project CentOS, or its derivatives, would not meet this requirement.

There are approximately 250 different programs within VA using applications hosted only on Red Hat, such as eBenefits, Benefit Discount Card/Veterans Identification Card, Loan Guaranty and JLV. In addition to these local VA programs, a collaboration between VA and DoD exists for HealthShare Enterprise Platform, VA/DoD Identity Repository and Community Care Reimbursement. These applications support critical VA programs that provide necessary services including, but not limited to, access to Veterans’ records, medications, services and Veteran historical data as well as payments to Veterans. These applications have already been developed, implemented, tested, validated, certified and awarded an ATO using the VA Assessment and Accreditation process. No other brand name product can work with the existing 250 programs. If VA were to identify an alternative product in the future, use of any other OS would require VA technical experts to re-code all the applications under the new OS while maintaining the existing OS. VA would have to modify the existing code of all 250 applications while continuing to improve, maintain and operate existing applications and OSs. This OS migration, which VA estimates would take a minimum of three years, is estimated to cost between $41.5 million to $75 million just for the migration of the aforementioned 250 programs. These estimates are based on previous acquisition history to deploy the existing Red Hat infrastructure and on previous migration efforts of similar size and scope. In addition, VA would have to continue to pay for the old OS subscriptions while the new OS development was conducted and completed. This duplication of effort would cost VA approximately $19 million annually to run the current Red Hat OS for the same three year minimum period until the migration was completed, totaling an estimated overall redundant cost of approximately $57 million based on the current costs to maintain the existing Red Hat OS.

Further, in addition to the above, use of any other brand name software subscription would require a complete redesign, re-implementation, retesting and ATO certification of the configuration to the alternate source OS for each of the 250 programs. Based upon past VA Enterprise Operations ATO certification experience, new certification cost estimates are approximately $150,000 per program or $37.5 million for the 250 programs that are currently hosting Red Hat software. The current RedHat subscription has already been granted ATO certification and thus would not result in duplicated costs. VA also has 216 additional ATOs with Red Hat products, with a total cost of approximately $32.5 million. Moving away from the Red Hat product lines in order to replace with another brand name software subscription would require a reaccreditation cost total of approximately $70 million for the aforementioned ATOs.

Therefore, migration to any alternative product while maintaining the existing OS for a minimum of three years is estimated to cost a minimum of $168.5 million, in addition to any potential increase in physical and virtual hardware server infrastructure costs and associated VA employees’ hours worked that would be required. These duplicative costs would not be recouped through competition.

Furthermore, none of the products proposed in the market research would allow for immediate transition of VA’s current documents and workloads, and would create a patchwork solution, increasing the risk of network vulnerabilities. Any partial replacement would require a minimum of five years to realize. This includes up to two years for planning, scoping, identification of impacted services and data, and establishment of a program office responsible for executing the effort. This would be followed by at least two years to procure and establish a development and testing environment, replicate information and infrastructure required, build out the target product environment, identify all required interfaces with existing data processes and environments, identify and integrate third party products required to establish seamless connectivity with the remaining environment and capabilities, conduct functional and operational testing and develop the required transition plans, including ATOs, roll-back plans, and any phased transition schedules addressing dual operations. The final phase is the actual migration and deployment, which could take up to an additional two years and still introduces potential risk for unacceptable mission stoppage or decreased capabilities due to nonsynchronous patching timelines for numerous separate manufacturer products, each of which could create vulnerabilities or break interfaces.

Finally, no other brand name professional services, maintenance or technical support can meet the Government’s requirements. Only Red Hat brand name professional services have access to proprietary code, support, and knowledge bases to be able to resolve internal bugs. RHEL OS requires Premium 24X7 Phone and Web Support and Technical Account Management Services for Red Hat Platforms. RHEL has proprietary rights to the OS and associated technical support. Therefore, the required associated technical support must be compatible with the existing OS. Only RHEL, or an RHEL reseller, has the rights to perform the associated technical support. Any other source must have access to the proprietary rights to ensure all the associated technical support provided is properly configured to both the OS and infrastructure. Without access to the proprietary rights, another source would not be able to push through signed RHEL source code or binaries updates. Having access to RHEL proprietary rights makes the signed binary compliant with VA’s overarching regulations. Any layered products offered by non-authorized Red Hat resellers would be without access to Red Hat’s engineering teams and would not be able to escalate requests to Red Hat, use Red Hat engineering tools or gain insight into Red Hat’s roadmap to provide advanced hot fixes and non-public patches for VA systems. Only Red Hat or an authorized Red Hat reseller would have access to Red Hat’s Customer Portal, ticket history, knowledge bases or support tools. If non-authorized vendors had to provide problem escalation and they could not resolve the problem, VA would be at a standstill because non-authorized resellers do not have access to Red Hat’s Technical engineering teams or staff, and VA would have to purchase an additional support contract from Red Hat to obtain escalated solutions. If this action is not awarded, VA would be in violation of Red Hat’s software and entitlement program usage agreement, and thus VA would be required to halt use and systems in production. This would cause an immediate impact to all VA veterans in health, benefits and cemetery services, which will be immediately degraded, to include critical life care services and payments to all Veteran, dependent and spouse services.

System downtime would prevent community care, partner and training providers access to VA electronic medical records, pensions and payment information.

No other vendor can provide training specifically for Red Hat products such as Red Hat Learning Subscriptions because Red Hat offers direct, authoritative content developed and delivered by the creators and maintainers of Red Hat technologies. The training includes access to official courseware, certification exams, real-world labs, and exclusive early access to new product content. These are resources that third-party vendors cannot replicate with the same depth, accuracy, or insider knowledge.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this Justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Red Hat licenses, as well as software maintenance, professional services, and support. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for the requirements described herein, the Government’s technical experts will continue to perform market research to determine if there are any products which will become available that will enable future requirements to be competed.

8. Market Research: In February 2025, the Government’s technical experts conducted market research. As part of this effort, a Request for Information (RFI) was issued through NASA SEWP V GWAC to identify alternative software products. The RFI received five responses from V3Gate, Red River, SDVO Solutions LLC, ETSI, and Aurora. Of the five respondents, V3Gate was the only option that was not a Linux-based clone. However, this addressed a single component of VA’s Red Hat product utilization, container hosting and management platform, and it did not provide all the necessary features required for VA’s continued operations. The other four—Red River, SDVO Solutions LLC, ETSI, and Aurora—offered rebranded versions of RHEL, ranging from RHEL’s shareware OS to Oracle Linux. These solutions would compromise OS versioning control, vulnerability management, and data mining protection, posing compliance risks under NIST Special Publication 800-53, as outlined above. VA contacted the vendors on August 13, 2025, and informed them their proposed solutions do not meet the VA’s requirements. No responses have been received as of August 19, 2025.

Additional research consisted of conducting web-based research including reviewing technical descriptions and product sheets of similar brands including Oracle Linux, CentOS, Amazon Linux, Debian, FreeBSD, SusE and Ubuntu, as well as other approved OSs, such as Windows and Solaris Unix, including software maintenance and technical support associated with each. Specifically, Government technical experts reviewed Enterprise Linux vendor websites for specifications on RHEL, Oracle Linux and Software and Systems Development Linux. No other software products were found to be interoperable or compatible with the existing Red Hat software. As described in Section 5 of this document, VA’s Linux infrastructure is designed with an underlying proprietary OS from Red Hat and will only integrate with the same proprietary OS. No other manufacturer has the ability to provide the signed Red Hat source code and binary software subscriptions. Each product distribution has its own calibrations and many of the configuration files are in different places and in a different format.

Additionally, no vendor other than Red Hat or its resellers can provide Red Hat published lists of support application and program interfaces, major and minor releases, signed Red Hat source code and binaries used for version control and critical updates, technical support, or professional services for the Red Hat software subscriptions because no vendor other than Red Hat or its resellers can access the signed source code binaries required by VA as they are proprietary to Red Hat. Based on market research, only signed Red Hat source code and binary software maintenance and technical support subscriptions can meet VA’s technical requirements due to security requirements as described in Section 5 of this document. Similarly, no other vendor can provide the required training since only Red Hat, or its authorized resellers, have access to the required Red Hat Learning Subscriptions to be used on Red Hat’s proprietary software.

Furthermore, additional market research was conducted in July 2025 by utilizing the Manufacturer Lookup tool on the NASA SEWP V website. This search identified 129 contract holders of Red Hat, 50 of which were listed as approved resellers. Of those 50 approved resellers, 21 were identified as Service-Disabled Veteran-Owned Small Businesses. As a result, there is reasonable expectation that competition exists on the NASA SEWP V for brand name Red Hat Software Subscriptions and Technical Support.

9. Other Facts: None

10. Technical/Requirements Certification

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination

I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated limited competition. Contracts awarded on NASA SEWP V contract have already been determined to be fair and reasonable. As there are multiple authorized resellers on the NASA SEWP V GWAC capable of providing brand name Red Hat software subscriptions which include renewal of software and associated maintenance and technical support described herein, price competition is anticipated. Finally, if necessary, the successful quote will be compared with the Independent Government Cost Estimate.

12. Contracting Officer Certification

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Office of General Counsel (OGC) Review

I have reviewed this document and find it legally sufficient, based on the representations set forth in the documents and, if any, attachments. The Senior Procurement Executive’s approval is an independently supported decision not wholly reliant on the legal sufficiency determination.

HCA Concurrence

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby concur with the acquisition of Red Hat software subscriptions which include of software and associated maintenance and technical support, professional services, and training and training engagements, pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.

Senior Procurement Executive Approval

In my role as Agency Senior Procurement Executive, based on the foregoing justification, I hereby approve the acquisition of Red Hat software subscriptions which include of software and associated maintenance and technical support, professional services, and training and training engagements, on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.