S02 JnA Imperva Redacted.pdf

Control Number: VA-25-00035795

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solution for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for the procurement of brand name Thales Imperva (Imperva) hardware maintenance and technical support with designated engineer support.

3. Description of Supplies or Services: The VA Office of Information and Technology (OI&T) Information Technology (IT) Operations and Services, Infrastructure Operations (IO) has a requirement for brand name Imperva hardware maintenance and technical support for X6510 servers, VM150 virtual appliances, 10 Gigabit interface cards, and SSL accelerator cards; with designated engineer support for Imperva Web Application Firewall (WAF) hardware with embedded firmware currently used in VA’s production environment. The existing VA owned Imperva hardware is one part of VA’s Imperva enterprise WAF solution used to ensure networks and systems in the VA are monitored, inspected, and protected from all web application activity entering the VA network. The Imperva hardware filters and monitors VA system logs and network connectivity to protect VA from information security threats. The required brand name Imperva hardware maintenance and technical support includes 24/7 telephone and email support to troubleshoot malfunctioning equipment/components, and provides replacement equipment/components as necessary to restore the Imperva hardware operation and accessibility to the original, redundant component configuration. Brand name Imperva hardware maintenance and technical support will ensure the Imperva hardware remains operational and functions as intended. OI&T IO requires retention of all hard disk drives and magnetic or recordable media that are defective.

Additionally, hardware maintenance includes any firmware upgrades, updates to major releases, point releases, service releases and security releases for applicable firmware on a quarterly basis or within 48 hours for instances where a high-risk vulnerability fix becomes available. OI&T IO requires brand name Imperva designated engineer support to provide technical expertise with assisting in troubleshooting for malfunctioning Imperva WAF appliances, and to restore the appliances to original configuration. In addition, OI&T IO requires a two-month option period to allow transition to new hardware.

Performance includes a base period of twelve months, with one two-month option period, noting the performance dates for individual hardware products is staggered to align performance end dates for all covered Imperva hardware. The total estimated value of this action is inclusive of the option period.

Brand Name Imperva Hardware Control Number VA-25-00035795 Maintenance and Technical Support

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), titled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited: Based on market research, as described in Section 8 of this document, it was determined that limited competition is available among authorized resellers of brand name Imperva and hardware maintenance and technical support with designated engineer support. Only brand name Imperva hardware maintenance and technical support with designated engineer support can be used for maintenance, and technical support for VA’s existing Imperva-based WAF and any replacement hardware, if needed. Any other brand name hardware maintenance with designated engineer support are unable to integrate with the currently fielded Imperva-based WAF. Additionally, no other brand name products or services will be interoperable or compatible with the currently fielded Imperva-based WAF. Specifically, the current WAF communicates through a source code that is based on Imperva proprietary data. No other network interface cards, accelerator cards, hardware maintenance and technical support, or designated engineer support can provide this communication capability or maintain the hardware without access to this source code. Specifically, the VA’s current Imperva infrastructure across the Enterprise, which consists of approximately 250 sites, communicates through firmware for both the administrative control interface which controls the network visibility fabric and the physical device interfaces which are used for clustering and load balancing, are proprietary to Imperva. As such, hardware maintenance and technical support with designated engineer support must have access to Imperva’s proprietary source code to develop and test code, as well as push patches, updates, and functionality through the VA’s fabric manager that will seamlessly interoperate with this infrastructure. The fabric manager is essential to supporting the Imperva infrastructure as it manages, implements, and allows VA to view the firmware version of the code in use for the current Imperva infrastructure and permits detection of any issues there may be with the Imperva hardware and firmware. Introduction of hardware maintenance and technical support with designated engineer support not developed by Imperva or its authorized resellers creates unacceptable risk to the entire VA WAF environment.

Additionally, without access to the proprietary source code, there is no way to test or validate the functionality or how the patch will interact with the deployed system, creating unacceptable risk to VA’s WAF, such as unknown vulnerabilities to the entire system. Furthermore, the Contractor must be an authorized reseller of the brand name Imperva products and services to have access to replacement parts that are proprietary to Imperva to meet form, fit, and function of the existing solution. Due to these proprietary constraints, the use of any alternative vendor products and services would necessitate a complete replacement of the existing Imperva infrastructure in VA’s production environment. The VA’s current investment is approximately for the Imperva infrastructure, training, and travel time based on SME’s purchase history knowledge. This figure does not account for the two-year time investment needed for VA engineering design, testing, procedure development, and implementation that would be required for a new product. Failure to acquire brand name Imperva hardware maintenance and technical support with designated engineer support would create an immediate risk to VA’s network security posture, such as the inability to protect Veteran’s data from traffic flow that may be malicious in nature. Only the proposed brand name Imperva products will meet the requirements to integrate and interoperate with the existing Imperva-based WAF infrastructure.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, it was determined that limited competition is viable among authorized resellers for brand name Imperva hardware maintenance and technical support with designated engineer support. In accordance with FAR 16.505(a)(4)(iii)(A)(1) this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), any resulting award and this justification will be made publicly available on the Contract Opportunities website within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government’s technical Subject Matter Experts (SMEs) conducted web-based market research in January 2025 by reviewing other, similar hardware maintenance and technical support with designated engineer support from various vendors, such as CommView and Solar Winds Netflow. While these other Original Equipment Manufacturers (OEMs) offer WAF products and services, none of these vendors products can meet the VA’s functional requirements as previously discussed. Only Imperva and its authorized resellers have access to the proprietary source code required to provide the necessary integration, interoperability, and compatibility with the existing VA Imperva WAF infrastructure. Specifically, none of the other OEM products and services can provide the access to Imperva’s source code necessary to meet the VA’s interoperability and compatibility requirements for the existing Imperva infrastructure. Based on all of these market research efforts, the Government’s SMEs have determined that only brand name Imperva hardware maintenance and technical support with designated engineer support can meet the Government’s requirements.

Additionally, the Contract Specialist (CS) conducted market research in January 2025 using the NASA SEWP V GWAC market research and Provider Lookup tools to determine what vendors are capable of providing the full requirement. Based on this market research, the CS identified 23 Service-Disabled Veteran-Owned Small

Businesses that are Imperva authorized resellers able to provide the required brand name products and services to meet the Government’s needs for this effort. As a result, there is a reasonable expectation for limited competition on the NASA SEWP

V GWAC.

9. Other Facts: Not applicable.

Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable because NASA SEWP V GWAC prices have previously been determined to be fair and reasonable. Additionally, price competition is expected among authorized resellers for this action. Price analysis may be performed in accordance with FAR 15.404- 1(b).

Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for brand name Imperva hardware maintenance and technical support with designated engineer support on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.