VA-22-00001734 Tenable JA to Post.pdf

Tenable Network Security software maintenance Control Number VA-22-00001734

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide

Acquisition Contract (GWAC) for brand name Tenable Network Security software maintenance.

3. Description of Supplies or Services: VA, Office of Information and Technology, Information Technology Operations and Services, Infrastructure Operations (IO), requires software maintenance for Tenable Network Security software currently in use at Austin Information Technology Center data center. The Tenable software maintenance shall consist of technical support via telephone, e-mail, or internet to troubleshoot malfunctioning software that restores full operation and accessibility to the original redundant configuration. In addition, software maintenance shall consist of firmware upgrades and updates to include major releases, point releases, service releases and security releases of applicable firmware on a quarterly basis, and/or within 48-hours in cases where a high-risk vulnerability fix becomes available. The Contractor shall provide one telephone number for VA to contact and open a maintenance support call. The Contractor shall provide support services 24 x 7 x 4 365. All VA support calls shall be initiated by a VA designated point of contact. When applicable, the Contractor shall provide secure connection capabilities for the downloading of software updates and/or the uploading of diagnostic information. The period of performance of the maintenance support shall be from October 1, 2021 to

September 30, 2022. The total estimated price of the proposed action is .

4. Statutory Authority: The statutory authority permitting this exception to fair opportunity is 41 U.S.C. 4106(c)(2) as implemented by Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited: Based on market research, as described in section eight of this justification, it was determined that limited competition is available for the required brand name Tenable Network Security software maintenance among authorized Tenable resellers. Tenable brand name software is the only software that can continue to build upon IO Security’s existing Tenable-based operating system (OS) vulnerability scanning system.

Other brand name OS and application scanning solutions were researched and unable to integrate with the currently fielded Tenable architecture and Tenable-based architecture licensing. Additionally, no other brand name OS vulnerability assessment system has been determined to be interoperable or compatible with the currently fielded Tenable-based brand name architecture. Specifically, the current system and software communicates through a source code that is based on Tenable proprietary data. No other software can provide this communication capability without this source code. Existing Tenable brand name security appliance inventory includes existing ownership of five existing Tenable-related physical appliances and licenses spread over five IO data centers. In addition to VA’s continuous monitoring requirement, these software appliances are needed to support the VA’s Information Technology visibility to the network initiative, which includes database discovery activities. Specifically, only Tenable brand name security appliances can provide upstream forwarding of any localized vulnerability discovery data into the existing IO Tenable architecture. The upstream of data is critical to produce a single view collective status of all OS vulnerability security related information over the network. This will ultimately continue to provide IO a single interactive view that displays the monitored IO’s network’s security posture of all network elements of OS protection.

Furthermore, any other brand name software cannot accomplish this because another product cannot communicate, nor integrate with the architecture and licensing of, the Enterprise Operations Console, and thus will not allow security visibility of database vulnerabilities on the network. Additionally, OS vulnerability data discovered and provided by another vendor will not integrate with the existing toolset, which is based on Tenable brand name security architecture and licensing.

In order to prevent interoperability issues because of the proprietary configuration and function of Tenable Security products, Information Technology Security products, like Tenable Security, only function within its own production environment and does not interoperate in a mixed vendor variety of licensing model or configuration while maintaining the central management requirement from existing production Tenable Security Center console. VA requires software upgrades, updates and patches for its existing Tenable Network Security software. Only Tenable Network Security software maintenance, provided through an authorized reseller, can provide the necessary software upgrades, updates, and patches because of the propriety source code required to develop and implement software updates. Since the software is proprietary, a legal restriction is placed on access to the software code that is required in order to develop upgrades, updates and patches to the software. For this reason, no other source, other than a Tenable Network Security authorized reseller, can provide the required software maintenance for the Tenable Network Security products. The brand name Tenable software maintenance and update support is the only software maintenance and update support coverage that meets the Government’s requirements. The maintenance and update support for the Tenable software is critical to ensure the current software continues to function within the current infrastructure without delays.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section eight of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. It was determined that limited competition is viable among authorized resellers for the required brand name Tenable Network Security software maintenance. In accordance with FAR 16.505(a)(4)(iii)(A)(2), this justification will be provided with the solicitation to all appropriate NASA SEWP V contract holders. Furthermore, in accordance with

FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the justification for this action will be posted on the Contracting Opportunities website within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the agency will work with the program office to continue to perform market research to consider and ascertain if any other sources can provide these services in the future.

Specifically, the Government will continue to investigate alternatives to Tenable

Network Security software maintenance that may be compatible with the current infrastructure, or whether Tenable permits third parties to access its proprietary software to provide maintenance and support. VA technical experts will conduct this market research throughout the year.

8. Market Research: In April 2021, the Government's technical experts reviewed similar software products to include their ability to provide software maintenance to ascertain if they could meet VA's requirements. The Government's technical experts conducted web-based research on web sites by researching other similar software from International Business Machines Corporation, Core Security Technologies, and Rapid7 to ascertain if other products could meet the Government’s requirements for interoperability and compatibility with IO’s existing Tenable Network Security software. As a result of the market research, the technical experts confirmed that the source code required to issue the upgrades, updates and patches is proprietary. Tenable Network Security is the only source capable of providing the required maintenance and upgrades for

Tenable Network Security software. No other brand name product has the capability of developing and issuing software upgrades and patches for Tenable Network Security software necessary to support existing IO requirements. Based on the above, only Tenable Network Security software maintenance meets all of the Government’s requirements.

Additional market research was conducted by utilizing the NASA SEWP Provider

Lookup tool to determine whether the brand name Tenable Network Security software maintenance is available from NASA SEWP V GWAC holders. It was determined that there are several resellers of the brand name Tenable Network Security software maintenance that hold current GWACs such that limited competition is anticipated.

9. Other Facts: N/A