S03 JA Sonatype_Final CO Signed-REDACTED_Redacted.pdf

Sonatype Nexus Repository Pro annual subscription licenses

CONTROL NUMBER

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for the procurement of brand name Sonatype Nexus Repository Pro annual subscription licenses, which includes standard support, with Sonatype Nexus NextGen Firewall and Sonatype Nexus IQ Server.

3. Description of Supplies or Services: VA Office of Information and Technology, Software Product Management, Benefits and Memorials Services (BAM) Portfolio and the Office of the Chief Technology Officer (CTO) has a requirement to procure 2060 brand name Sonatype Nexus Repository Pro and premium success support for the Benefits Integration and Administration (BIA) Product Line, Benefits Integration Platform (BIP). Sonatype Nexus Repository Pro is a repository manager that organizes, stores, and distributes artifacts needed for development. With Nexus Repository, developers can completely control access to, and deployment of, every artifact in an organization from a single location, making it easier to distribute software. The Sonatype Nexus platform protects the entire software development lifecycle for applications at the BIA by keeping untrustworthy components out of the software supply chain. A component is a package or resources that the BIA software application uses. Sonatype Nexus Repository Pro assesses blocks of code that have been custom coded by the development team and automatically stops defective open source components from entering VA’s software supply chain. Sonatype Nexus Repository Pro will also manage libraries, store artifacts in a universal repository and share them across development teams. Additionally, the Sonatype Nexus Repository Pro efficiently distributes parts and containers to developers which supports Agile and DevOps efforts to accelerate development, test, and production cycles. These capabilities are critical to enabling software delivery across the BAM portfolio and the Office of CTO, supports adherence to VA vulnerability remediation service level agreement and ensures that product teams meet the Presidential Executive Order to adopt and mature adherence to Zero Trust Architecture. The required subscription licenses will include standard software support available from 8:00am-8:00pm Eastern Time, Monday through Friday.

The period of performance shall consist of a month base period with two month option periods and one optional task. The total estimated value of the proposed action is inclusive of the options.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation Overhaul (RFO) VA Deviation 16.507-6(a), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by RFO VA Deviation 16.507-6(b)(2), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: The BIP and CTO Software Factory previously deployed the open-source version of Sonatype Nexus Repository to protect the entire software development lifecycle by vetting parts automatically to stop defective open-source components from entering BIP and BIP Tenants’ software supply chain, manage libraries and stores artifacts in a universal repository and share them across development teams. VA requires support for additional applications that will be required to utilize Nexus, which are not included with the free version but are included in the paid version of Sonatype Nexus Repository Pro annual software subscriptions, which are compatible and interoperable with the existing Nexus footprint within BIP. The paid version called Sonatype Nexus Repository Pro includes the following: Staging & Build Promotion, Security Assertion Mark-up Language (SAML)/Single Sign-On(SSO), Enterprise Lightweight Directory Access Protocol (LDAP) (Auth Tokens), Runtime Storage Expansion/Migration, Advanced Repository Health Check Report, Component Replication, Deploy to npm & Docker Groups, Resilient Failover, Custom Component Metadata, World Class Support, and a dedicated Customer Success Team. To support VA’s software project teams and customers, VA BIP requires software repository features and support levels included with a software repository system to manage software artifacts (including files, components, libraries, assets) and help maintain the integrity of VA BIP software solutions now and in the future. The software repository features required to maintain integrity for VA customers include but not limited to:

high availability; software artifact security checks; secure data transmission; secure user and automated logins; software artifact analysis; software artifact dependency management; complex and efficient central point for software artifact storage, retrieval, publishing, sharing and distribution; proxying other repositories; software supply chain automation; complex software staging and building on different computing platforms; complete access control and deployment of artifacts; software artifact searching, browsing, and tagging capabilities; integration with common development environments; plugins for continuous integration servers; command line tools for custom integration with other software and systems. The Sonatype Firewall acts as an automated security perimeter for software development. It automatically intercepts open-source packages and dependencies downloaded from public repositories, blocking vulnerable or malicious code from ever entering your internal development environment. Additionally, Sonatype Nexus Repository manages components from development through delivery, provides advanced support for the Java Virtual Machine ecosystem, including Gradle, Ant, Maven, and Ivy and is compatible with popular tools like Eclipse, IntelliJ, Hudson, Jenkins, Puppet, Chef, and Docker. The applications being developed and maintained within the BIP Software Factory ecosystem and the Office of Chief Technology Officer (CTO) are specifically engineered to utilize Nexus. If the VA transitions to a new solution or any alternative to support this function, the reengineering of existing applications is estimated to cost approximately and would likely require more than months to complete. These estimated duplicative costs would not be recovered through competition. Reengineering of the affected VA BIP Software Factory solution and tenant applications would require extensive diagnosis and risk assessment, require training and put congressional mandated and other high priority business delivery timelines at risk due to reengineering, extensive evaluation, risk assessment, and training of an alternate solution. The time required to complete this process would put congressional mandated and other high priority business delivery timelines at risk. Sonatype Nexus Repository fits into BIP’s Software Factory Model and the Office of CTO and span of control, providing software artifact compliance and code scans, version controls, and active directory integration with Single-Sign-On (SSO) via Security Assertion Markup Language (SAML), which is a feature that is not included in the open-source version. VA requires this feature to support the continued growth of the BIP Software Factory and it is necessary to support Multi-factor authentication (MFA) with Personal Identity Verification PIV cards to achieve Zero Trust Architecture Initial maturity level for the Identity pillar. In a Zero Trust architecture, the Identity Pillar is the foundational element that ensures only verified, authorized entities—people, devices, or services—can access resources. It focuses on identity-centric security, where access is granted only after strong authentication, least-privilege authorization, and ongoing risk assessment. Sonatype Nexus Repository provides a centrally managed and security-controlled software code versioned repository to ensure deployments remain consistent, alleviating administrative overhead with system administration. Sonatype Nexus Repository ensures code deployments are tied to the particular branch and only pulls from an approved source artifact repository maintained by branch and version. Consistent and versioning control over artifacts prevents erroneous server configurations ensuring consistent environments required to baseline application deployments, testing and security scanning. Any product other than Sonatype Nexus Repository would not allow consistent monitoring of the BIP Software Factory for unauthorized applications that are interoperable with the current BIP hosted tenant applications utilizing Nexus. Not having this cybersecurity capability would mean that non-sanctioned code could be added/implemented to monitor and/or insert nefarious routines.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that could meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name Sonatype Nexus Repository Pro annual subscription licenses, including standard support. In accordance with FAR Overhaul VA Deviation 16.507-6(c)(1)(i), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government’s technical subject matter experts (SMEs) conducted market research in January 2026 to ascertain if there are viable alternatives who could meet VA’s requirements. VA SMEs evaluated products several products to determine their ability to support VA requirements, including JFrog Artifactory, AWS CodeArtifact, AWS Elastic Container Registry (ECR), and open-source Harbor. The review found that these alternatives did not satisfy several critical requirements.

Specifically, none of the alternatives provide robust Staging & Build Promotion capabilities, which are essential for VA’s software development and deployment workflows. Furthermore, AWS CodeArtifact, AWS Elastic Container Registry (ECR), and open-source Harbor lack Advanced Repository Health Check reporting, a feature crucial for maintaining the integrity and security of VA’s software supply chain.

Based on market research efforts, the Government’s technical experts have determined that only Sonatype Nexus Repository annual software subscriptions can meet all of VA’s needs.

Additionally, market research was conducted in May 2026 through the use of the Provider Lookup Tool on the NASA SEWP V GWAC web site to determine whether the brand name Sonatype Nexus is available from NASA SEWP V GWAC Contract holders. It was determined that there are thirteen approved Service-Disabled Veteran-Owned Small Businesses (SDVOSB) resellers of the brand name Sonatype Nexus that hold current GWACs. Therefore, limited competition is expected among SDVOSBs for this proposed action.

9. Other Facts: N/A

10. Technical/Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief