S02 REDACTED EFO F5 Network Software Licenses and Maintenance.pdf

F5 Networks Support License Subscription Services CONTROL NUMBER VA-25-00045444

JA Template_FAR 16.5_(07-AUG-2024)

JUSTIFICATIONFOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a Firm-Fixed-Price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurements (SEWP) V Government Wide Acquisition Contract (GWAC) for two (2) each brand name F5 Networks BIG IP perpetual software licenses and maintenance support and premium software maintenance support for a period of twelve (12) months.

3. Description of the Supplies or Services: VA, Electronic Health Record Modernization-Integration Office (EHRM-IO), requires the purchase of Four(4) F5 Networks BIG IP (12) month perpetual software licenses and premium renewal support license subscription services. The required support licenses shall be delivered 30 calendar days after award with maintenance support services for twelve (12) months from date of award. This requirement does not include product development or installation services. The total estimated price for the proposed action is $ .

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: The required F5 Networks BIG IP support license subscription services will be deployed at the Oracle Cloud Infrastructure (OCI) in Chicago to expand the capacity of the System Security Architecture (SSA) to support increased usage on the pre-production platform and provide separation between the pre-production and production platforms. EHRM-IO is securely connecting VA medical centers and clinics to the Oracle data center where their Electronic Health Record (EHR) solution is being hosted. The hosting environment is jointly managed by the Department of Defense (DoD) and VA. To comply with the 2008 National Defense Authorization Act, requiring DoD and VA interoperability of health record systems, the VA and DoD are implementing a jointly managed EHR using Oracle’s Millennium solution. This solution is hosted in the Oracle Data Center. Access to the jointly managed EHR is achieved by a connection to the DoD’s Medical Community of Interest (MedCOI) network. MedCOI is a virtual network with detailed technical specifications and operational procedures implemented to ensure the privacy

JA Template_FAR 16.5_(08-AUG-2024) of protected health information as required by the Health Insurance Portability and Accountability Act of 1996 and other federal laws and regulations.

The joint management of the EHR requires, in part, that DoD and VA work together to ensure operational availability, performance and security of the infrastructure supporting the EHR. In furtherance of this requirement, on February 13, 2018, VA and DoD signed the DoD/VA Joint Electronic Health Record Architecture Description, which established the common security architecture for VA Medical Centers/Clinics and MedCOI connecting to the EHR system. The SSA, a component of the common security architecture, is an agreed upon architecture between the DoD and the VA used to monitor traffic across security boundaries of the converged DoD and VA infrastructures that interface directly with the shared EHR environments. In compliance with the DoD infrastructure, the SSA requires hardware equipment compatible and interoperable with existing protocols and functionality for monitoring traffic to the MedCOI wide area network (WAN) infrastructure and the EHR.

Since DoD is currently using F5 Networks BIG IP Switches, VA cannot use any other networking products because untested non-DoD certified Cybersecurity products would cause interoperability issues among existing VA sites accessing the Oracle EHR and cause a total loss of access to patient health records. Only F5 Networks BIG IP Switches and their resellers have access to the current hardware and software that communicates through a source code based upon F5’s proprietary data currently in place at VA, DoD and Oracle Health locations supporting the EHR.

Additionally, only F5 or its resellers can provide the required hardware license maintenance support as only they have access to, and knowledge of, the hardware’s firmware and configurations necessary to keep the hardware operational and secure.

Therefore, no other networking products can meet VA’s MedCOI WAN infrastructure compatibility and interoperability requirements. Failure to acquire the hardware license maintenance support subscription services would leave the VA without the necessary equipment maintenance required to monitor and protect Veteran, beneficiary, and VA Business partner’s data In addition to the administrative burden and schedule impacts, the VA and DoD would incur to procure, install, and certify a new monitoring system and devices, if the DoD would agree to a change in vendor equipment, the cost is approximately $10,073,582.80, including solution re-engineering and system recertification, to replace the DoD and VA F5 Networks BIG IP Switches.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, it was determined that limited competition is viable among resellers for these brand name items. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR

5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

JA Template_FAR 16.5_(08-AUG-2024)

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government’s technical experts conducted web-based market research in December 2024 and reviewed similar products from alternative manufacturers such as KVM and NETGEAR. While similar products exist, they do not meet VA’s requirements because they are not certified and compliant with the SSA and DoD and VA’s existing F5 Networks BIG IP Switching equipment. Therefore, only F5 Networks BIG IP Switches can support VA’s currently installed and anticipated deployment of traffic monitoring equipment in the SSA.

On December 6, 2024, market research was performed via request for Information (RFI # 330449) using the NASA SEWP V Provider Lookup Tool to determine sources that could provide the required F5 Networks maintenance, and support licenses needed.

Results of the market research indicate there was an adequate number of authorized resellers who can meet the Government’s needs. All four (4) of the RFI responses were from Service-Disabled Veteran- Owned Small Business (SDVOSB) authorized resellers in Group B of NASA SEWP.

Additional market research was performed by the Contract Specialist in February 2025 utilizing the NASA SEWP V GWAC Market Research tool, which identified 56 contract holders that are resellers of F5 Networks, Inc. products and services. Of these 56 resellers, 14 are verified Small Disadvantaged Veteran Owned Small Businesses, 1 is a Veteran Owned Small Business, 9 are Woman-Owned Small Businesses, 4 are Historically Under-utilized Business Zone Small Businesses, 11 are Small Businesses, and 17 are Large Businesses. Furthermore, the NASA SEWP V GWAC has a dynamic catalog where line items can be added based on customer requests; therefore, as long as the required item or service is within scope of the NASA SEWP V GWAC, items and services can be added to the catalog on a daily basis. This requirement has been found to be within scope of the NASA SEWP V GWAC in a separate determination.

As a result of the aforementioned market research, there is reasonable expectation competition exists on the NASA SEWP V GWAC amongst two or more SDVOSB concerns for F5 Networks, Inc. Licenses and Maintenance Support, and accordingly, this effort will be released to all SDVOSBs in groups B, C and D on the NASA SEWP V

GWAC.

9. Other Facts: None

10. Technical/Requirements Certification

JA Template_FAR 16.5_(08-AUG-2024)

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Joel Gochin, Program Manager Date Network Infrastructure, EHRM-IO

11. Fair and Reasonable Cost Determination I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on fair and reasonable based on a comparison of the successful quote to other quotes received in response to the solicitation. Additionally, the successful quote will be compared to the Independent Government Cost Estimate.

Finally, the successful quote may be compared to pricing indexes, and competitive published list pricings for the same or similar products.

Ms. Wendella Baptiste Date Contracting Officer

12. Contracting Officer Certification/Approval I certify that this justification is accurate and complete to the best of my knowledge and belief. This contract action exceeds the simplified acquisition threshold, but does not exceed $750,000, therefore, the certification required by FAR 16.505(b)(2)(ii)(A) serves as the Contracting Officer’s approval.

Ms. Wendella Baptiste Date Contracting Officer