S06- JA Prisma Cloud Renewal_FINAL-UPDATED_1.22.25-JB-REDACTED.pdf

Brand Name Prisma Cloud Compute Edition software licenses renewals and premium success support | Control Number: VA-25-00011823

JUSTIFICATIONFOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for Brand Name Prisma Cloud Compute Edition software licenses and premium success support for the office of Benefits and Memorials Services (BAM).

3. Description of Supplies or Services: The VA Office of Information and Technology (OI&T), Product Delivery Service (PDS), Benefits and Memorials Services (BAM) Portfolio has a requirement to procure a renewal of annual subscriptions, Brand Name Palo Alto, Prisma Cloud Compute Edition software licenses and premium success support for the Benefits Integration and Administration (BIA) Product Line, including;

Benefits Integration Platform (BIP) and Benefits Enterprise Platform (BEP) which are both considered Bedrock systems for the VA. The procurement will include 4,300 software license renewal for Prisma Cloud Compute as well as Premium Success Support for US Government accounts to provide a common Cloud Native Application Protection Platform (CNAPP) solution for BIA products as well as BIP hosted tenants services aligned to the Enterprise Management of Payment Workflow and Reports (eMPWR- VA), Memorial and Benefits Services (MBS), Benefits Integration Administration (BIA) and Compensation and Pension (C&P) Product Lines, including critical system such as Veterans Benefits Management System (VBMS) to provide near real time security scanning and reporting capabilities for infrastructure hosts, applications, container images and serverless functions, in a single pane of glass. The VA requirements are as follows:

The VA, BIA Product Line requires a Cloud Native Application Protection Platform solution that can either be hosted on VA servers (on-prem) or is a Federal Risk and Authorization Management Program (FedRAMP), High Software as a Service (SaaS) offering. Furthermore, on-prem solutions must have a pathway for Technical Reference Model (TRM) approval.

The VA, BIA Product Line requires support US only vendor support for Commercial Off The Shelf (COTS) products that are hosted by VA servers as well as container management solutions offered as services by cloud vendors.

The VA requires an easily scalable solution due to the growing use of BIP as a container-based environment as well as accommodate for the larger needs of the BIA Product Line including BEP for near real-time host and serverless function scanning.

The VA, BIP Product requires centralized view and control to view and address findings and risks across cloud, Kubernetes clusters, hosts and containers to ensure visibility into vulnerabilities for all Products/Systems hosted in support of the Authority to Operate (ATO) for BIP as well as BEP.

The VA, BIA Product Line requires that the solution can collect and route findings with customized rules and Role Based Access Control (RBAC) to the appropriate Product Line, Product and specific system so that aligned system owners are able to properly address findings and maintain their systems and associated tenant assessment packages.

The VA, BIA Product Line requires that the CNAPP solution is able to integrate with multiple industry standard solutions already in use at the VA, including Atlassian Jira for automated ticket creation of findings that can be aligned to the appropriate product line and product team backlogs.

The VA, BIA Product Line requires that the CNAPP solution at a minimum uses the Common Vulnerability Score System (CVSS) v3.1 scoring schema that can be mapped to VA Service Level Agreements (SLA) for remediation as defined in the VA 6500.

The VA, BIA Product Line requires that the solution can identify when a vulnerability is first identified in the given environment to support alignment to VA defined SLAs for remediation.

The VA requires that the solution supports the ability to export detailed reports into comma separated values (csv) format so that the data can be used for custom analysis and reporting and support the ability to import the data into critical VA tools such as eMASS to maintain ATO packages and Information Central Analytics and Metrics Platform (ICAMP).

BIA BIP Product requires the ability to maintain requirements for Continuous Integration/Continuous Deployment (CI/CD) pipeline vulnerability scanning in order to remain on track with Zero Trust Architecture Mandate M-22-09 compliance.

The VA requires that the solution provides automated runtime security for running containers as well as automated alerts when suspicious runtime activity is identified, in real-time without manual intervention. The solution must also provide an easy-to-configure rule set that allows for global or fine-grained application of security policies to enable seamless transitions from alerting to prevention in pursuit of increasing the Zero Trust Architecture Mandate M-22-09 compliance.

The VA requires that the solution supports Web Application and API Security (WAAS) to protect both web-based applications hosted on hosts and containers from a range of attacks, including but not limited to: SQL injection, Cross-site scripting (XSS), Malformed request protection, etc. The solution must also support API traffic security enforcement based on OpenAPI specifications.

The VA requires that the CNAPP solution support default (out-of-the box) and customizable protection of filtering and scrubbing of sensitive information, such as Personally Identifiable Information (PII), from runtime events to ensure that sensitive information is excluded from runtime findings, including forensic data, incident reports, and audit logs.

These capabilities are critical to the continuation of modernization efforts across the BAM portfolio, ensuring adherence to VA vulnerability remediation service level agreement (SLA) and ensuring that product teams meet the Presidential Executive Order to adopt and mature adherence to Zero Trust Architecture (ZTA).

The period of performance will be a 12-month base period from February 1, 2025 to January 31, 2026 and also includes two (2), 12-month option periods and two optional tasks for additional licenses. The optional tasks will provide additional licenses to support the future growth of new tenants joining BIP. The total estimated price for the proposed action is .

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was determined that limited competition is available among resellers for the required brand name Prisma Cloud-Compute Edition software developed by the Original Equipment Manufacturer, Palo Alto, Networks, Inc.

The Government requires a single container scanning solution that can be utilized across BIA Products. Brand name Palo Alto Prisma Cloud-Compute Edition software meets the VA requirements and incurs the least amount of impact, implementation timeline and costs

The brand name Prisma Cloud Compute software has been in use on the BIP product since 2020 and is integrated into over 90% of our CI/CD Pipelines across 52+ tenants aligned to 4 products lines in the BAM Portfolio including Compensation and Pension

(C&P), Memorial Benefits Services (MBS), Benefits Integration Administration (BIA) and Education Veteran Readiness Employment (EVRE). A transition in tooling solution would incur significant risks (as described below), additional cost of and an impact to delivery timelines across all listed product lines. Consequently, Brand name Prisma Cloud-Compute Edition software by Palo Alto, Networks is the only software that met all the requirements, provided parity for current capabilities in one solution and results in the least amount of time and technical resource costs to implement. If Prisma Cloud Compute is not procured the VA BIA Product Line would have to combine multiple open-source solutions or combine open-source with COTS solutions to arrive at an equivalent solution as Prisma Cloud Compute Edition. The BIP Product team estimates if brand name Prisma Cloud Compute Edition software is not purchased, that acquiring, integrating, and implementing other individual software solutions would require an additional twelve (12) months across 2 scrum teams which would mean a loss of current functionality for container scanning and vulnerability insight across BIP. This will result in numerous downstream negative impacts on the delivery schedules for PACT Act initiatives and architectural improvement modernization plans for the Veterans Benefits Administration services such as Veterans Benefits Management System , Work Queue, Data Sync, VA Profile and Records Resource Center aimed to increase claim accuracy, reduce claim cycle time through the ability to leverage real-time data to inform decisions regarding enrollment, eligibility, patient care and billing which will have direct and negative impact on Veterans and their families. Additionally, to implement an alternative solution will result in duplicative costs of to replace software products and services.

Furthermore, if Palo Alto Prisma Cloud-Compute Edition software is not acquired, VA will be unable to fully meet visibility to Known Exploited Vulnerabilities (KEVs) compliance requirements of Cybersecurity and Infrastructure Security Agency (CISAs) Binding Operational Directive (BOD 22-01- Reducing the Significant Risk of Known Exploited Vulnerabilities). Failure to procure the required brand name software would result in disruption to current Information Assurance (IA) processes for a minimum of 4 Product Lines under the BAM Portfolio and will result in a gap in ability to observe and address vulnerabilities in near-real time. Failure to procure this brand name software will

(M-22-09) and lastly, compromises VA Systems and Veteran data.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, it was determined that limited competition is available among resellers for this brand name requirement. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation on the NASA SEWP V GWAC website for review by all prospective offerors.

Furthermore, in accordance with FAR 5.301 and 16.505(b)(2) notice of award of this action will be synopsized on the sam.gov website within 14 days of award and this justification will be make publicly available.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: The Government's subject matter experts (SME) conducted market research from October 2024 through December 2024. Market research (MR) consisted of product research on the internet, product demonstrations from vendors, proof of concept testing, discussions with other programs supporting the VA to ascertain if other sources could meet the needs of the VA, BIA Product Line. Software evaluated included open-source and COTS products such as;

Based on the reviews of available solutions, meet all of the discussed in Section 3.

and products do not offer an on-premises solution. , and

: solutions are not standalone Cloud-Native Application Protection Platform (CNAPP) solutions. While they provide certain cloud security functionalities, they lack the comprehensive CNAPP capabilities required for BIP from section 3. :, lacks robust features for grouping and routing findings by product line, product, and tenant, which is critical for BIP use cases. Further analysis revealed that does not meet the requirements for Automated runtime security and alert, Web Application and API Security (WAAS) or Out-of-the-box and customizable protection for filtering and scrubbing sensitive information.

MR determined that limited competition is available among resellers for the required brand name Prisma Cloud Compute Edition License renewals and Premium Success Support, developed by Palo Alto Networks, Inc. As determined that only brand name, Prisma Cloud Compute Edition provided by Palo Alto Networks, Inc. or one of its authorized resellers can provide the proprietary solution software and premium success support that can meet Prisma Cloud Compute Edition is the only software that supports these requirements. No other vendors in the industry currently have access to the proprietary data and rights in order to provide the required software support.

The Contract Specialist (CS) conducted MR by looking up previously awarded contracts with the VA for brand name Prisma Cloud software and premium success support services. Further, MR was conducted by utilizing NASA SEWP V GWAC, via the Provider Lookup Tool to ascertain that brand name Prisma Cloud Compute Edition Software License Renewals and Premium Success Support by Palo Alto Networks Inc.

could be procured via potential Service-Disabled Veteran-Owned Small Businesses (SDVOSB) vendors. Based on additional market research, the CS found 22 SDVOSB vendors that are capable of meeting the full requirement. Of the SDVOSB vendors returned from the search, 17 of which are approved resellers for Palo Alto Networks Inc.

products and services.

9. Other Facts: NA.