S03_24-HW0040_JA FireEye_Redacted.pdf

Control Number VA-24-00046368

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Acquisition and Logistics Technology Acquisition Center 260 Industrial Way West Eatontown, NJ 07724

2. Description of Action: The proposed action is the issuance of a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for brand name hardware maintenance support of the Trellix FireEye, Inc. network appliances.

3. Description of the Supplies or Services: VA, Office of Information and Technology (OIT), Software Product Management (SPM), Infrastructure Operations (IO) has a requirement for hardware maintenance support for brand name Trellix FireEye, Inc.

(FireEye) Network appliances. The requirement is for the maintenance support to the existing FireEye architecture and infrastructure IO data centers. The Contractor shall provide maintenance and technical support for remedying software and hardware defects as well as enhancing and optimizing software. The maintenance support shall include all new fixes, patches, corrections, releases, updates, versions, and upgrades to the software. The technical support shall include 24x7x365 assistance for the hardware and software via telephone, e-mail, or website. Security architecture that is within the different VA data centers. The expansion of the current IO solution is required to align IO’s Information Technology Center with the Federal Information Security Management Act.

The base period of performance shall be from August 30, 2024 through August 29, 2025, with two 12 month option periods. The total estimated price of the proposed action is , inclusive of all options.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on the market research described in Section 8 of this justification, it has been determined that limited competition is available for the FireEye hardware maintenance support among authorized resellers. The existing IO network monitoring architecture and infrastructure consists of FireEye malware protection appliances located across IO data centers. No other malware protection appliances are interoperable or compatible with the existing FireEye-based malware protection systems and architecture. The current appliances and associated software communicate through a proprietary source code, and no other

Trellix FireEye Hardware Maintenance Renewal Control Number VA-24-00046368 software can provide this communication capability without proprietary source code.

Specifically, only FireEye security appliances can provide upstream forwarding of any localized malware activity data into the existing FireEye architecture. The upstream forwarding of malware data produces a single view collective status of all security-related activity over the network and displays the security posture of all elements operating on the network. No other brand name hardware and software appliance can accomplish this functionality because no other product can communicate or integrate with the existing FireEye architecture, infrastructure and licensing with the single collective view IO Console, and thus will not allow monitoring and visibility of malware activity on the network.

While other devices such as International Business Machine’s (IBM) Security Network Intrusion Prevention System, Cisco IronPort, and PaloAlto WildFire provide malware protection and monitoring, no other products are interoperable with IO’s existing FireEye architecture. Therefore, no other product can operate in VA’s FireEye architecture.

Additionally, data monitoring and malware activity captured by another vendor will not integrate with the existing IO FireEye infrastructure components. Acquisition of different network monitoring devices and support would require a separate infrastructure to support a new malware protection appliance, resulting in duplication of cost previously expended in the existing infrastructure that would not be recovered through competition.

Additionally, the required software licenses and maintenance support, which consists of software updates, firmware updates, patches, and defect support can only be provided by FireEye or an authorized reseller. FireEye software is proprietary; no other vendor can access the necessary source code or have the capability to perform fixes and updates of the FireEye products. The proprietary source code is not available to third-party vendors; therefore, no other vendor other than an authorized reseller can provide the required software and firmware updates for FireEye products. Due to these proprietary constraints, use of any alternative service provider would necessitate the complete replacement of the existing brand name FireEye infrastructure. Such a replacement effort is estimated to cost approximately and would take approximately 18 months to accomplish. These estimates are based on previous acquisitions and implementation experience. These duplicative costs would not be expected to be recovered through competition.

Failure to procure the required brand name FireEye hardware maintenance support would compromise VA’s ability to protect against hundreds of malicious network and system cybersecurity activities. FireEye is also a primary visibility point for existing production automated threat response and containment processes across other production cybersecurity infrastructure within data centers and across the VA enterprise. Without continuation of the required maintenance support, the protection that FireEye provides against VA system and VA data compromise (in support of continued VA systems providing Veteran benefit and services), would be hampered leading to potential harm and cessation of Veteran services. Therefore, only the FireEye hardware maintenance can meet the Government’s requirement.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined, however, that competition is available among authorized resellers for the brand name FireEye maintenance as there are thirty-six resellers of FireEye products and services on the NASA SEWP V GWAC.

In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), this action will be synopsized upon award on the Federal Business Opportunities Page within 14 days after award, and this justification will be made publicly available. In accordance with FAR 16.505(a)(4)(iii)(A)(2), this justification will be provided with the solicitation to all contract awardees on the NASA SEWP V GWAC.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there changes in the marketplace that would enable future requirements for the required malware protection appliances described herein to be competed.

8. Market Research: The Government’s technical experts conducted market research in March and April 2024 to confirm that the FireEye operating systems remain proprietary and that only brand name FireEye or its authorized resellers can provide the required hardware maintenance. Specifically, the Government’s technical experts reviewed similar malware protection full packet capture systems including International Business Machines Security Network Intrusion Prevention System, Cisco IronPort, and PaloAlto WildFire appliances. As a result of that market research, the Government’s technical experts confirmed that only brand name FireEye appliances are interoperable with the existing IO FireEye architecture and associated infrastructure products, therefore only FireEye or their resellers can provide the required maintenance.

On May 2, 2024 the customer issued a NASA SEWP V Market Research Request (MRR) and it closed on May 9, 2024. Three responses were received timely in total; all three responding vendors were Small Business Administration (SBA) Veteran Small Business Certification (VetCert) verified Service-Disabled Veteran Owned Small Businesses (SDVOSBs), with active System for Award Management (SAM.gov) registrations. All responses offered Trellix FireEye and no alternate solutions were proposed. All responses were deemed technically acceptable by the Government’s technical experts.

The Contract Specialist (CS) conducted additional market research in May 2024 by using the NASA SEWP V GWAC Provider Lookup Tool to determine what vendors could meet the requirement using keyword: FireEye, which returned provider Trellix, with aliases FireEye, FireEye Security Holdings US LLC, and FireEye, Inc. The search returned 103 Contract Holders with 72,246 number of products. The CS confirmed 63 Contract Holders were Approved Resellers under NAICS Code 541519.

Based on the results of the review set forth above, there is reasonable expectation that two or more SDVOSBs will be able to provide the required support. Therefore, given that there is reasonable expectation of competition between at least two capable SDVOSBs, it has been determined by the Contracting Officer that the subject Request for Quote will be released as a SDVOSB set-aside under the existing NASA SEWP V contract vehicle, under the Value-Added Reseller NAICS code 541519.

9. Other Facts: None

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of hardware maintenance support for brand name Trellix FireEye, Inc. network appliances on an other than fair opportunity basis pursuant to the authority cited in paragraph 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.