JA 1E Tachyon Redacted.pdf

Control Number VA-24-00043451

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name 1E Tachyon Endpoint License Subscriptions.

3. Description of the Supplies or Services: VA, Office of Information & Technology (OIT) End User Services (EUS), End User Operations (EUO), Endpoint Engineering has a requirement for 600,000 brand name 1E Tachyon Endpoint License Subscriptions in the base period, to be renewed each option period, which will cover all Windows based VA endpoints in the enterprise. 1E Tachyon is a Digital Employee Experience (DEX) and Endpoint Management tool that provides real-time visibility and control of endpoints on and off the VA network. 1E Tachyon provides VA with rapid identification and remediation of emergent security problems, automated configuration and change management, as well as the automated remediation of unhealthy clients (self-healing), endpoint performance monitoring using synthetic transactions, user sentiment-gathering related to the stability, responsiveness and performance of endpoints, and the users’ overall digital experiences. 1E Tachyon also provides VA with application monitoring, enterprise reporting, patch compliance monitoring, bandwidth-aware content delivery, integration with standard VA software distribution, and patching tools, hardware, and software inventory-gathering. 1E Tachyon provides for the analysis and augmentation of Information Technology Service Management (ITSM) (ServiceNow) by automating common help desk tasks and providing self-service functionality, resulting in increased efficiency, cost-avoidance, and end-user satisfaction. The period of performance shall be 12 months from date of award with 2, 12-month option periods, as well as 1 optional task for additional 1E Tachyon Subscriptions with a not-to-exceed quantity of 100,000.

The estimated price of the proposed action is $36,727,462.00, inclusive of the option periods and the optional task.

4. Statutory Authority: The statutory authority permitting this exception to fair opportunity is Section 41 U.S.C 4106(c)(2) as implemented by Federal Acquisition Regulation (FAR) Section 16.505(b)(2)(i)(B) entitled, “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

Brand Name 1E Tachyon Control Number VA-24-00043451 Endpoint License Subscriptions.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this justification, only the proposed 1E Tachyon Endpoint License Subscriptions can meet the Government’s technical requirements described below. 1E Tachyon is currently in use on 170,800 VA endpoints and VA requires the procurement of brand name 1E Tachyon Endpoint License Subscriptions for EUO to continue to manage the digital employee experience of all customers, automate health optimization of VA’s endpoints to include offline (no network connectivity), fully automated remediation of problems (self-healing), remediate problems in real-time at scale, gather information on Government furnished equipment on and off the VA network, automate tasks, leverage content distribution technology, and integrate with ITSM and nationally-deployed endpoint management tools. 1E Tachyon is the only tool that can integrate with 1E Nomad, Microsoft Systems Center Configuration Manager (SCCM), and Service Now to deliver offline remediation of endpoint health problems, while also meeting VA’s dedicated Digital Employee Experience (DEX) tool needs. 1E Nomad is VA’s standard content distribution tool that uses a peer-to-peer distribution model and intelligent bandwidth management, removing the need for dedicated hardware and allowing VA to operate a vast Microsoft SCCM Operating System Deployment (OSD) architecture without impacting the network. Service Now is VA’s service desk tool and is key in VA’s efforts to improve the DEX and reduce costs.

Microsoft SCCM and Microsoft Intune are the primary VA tools for Enterprise security patch management, security software management, Enterprise Reporting (compliance, executive-level, operational), vulnerability management, visibility to all VA endpoints, delivery and installation of national software packages, operating system deployment, asset management, license tracking, endpoint configuration management, and computer power management. These tools are currently managing approximately 600,000 VA endpoints (workstations, laptops, servers). However, for endpoint management, unlike 1E Tachyon, neither of these tools (Microsoft SCCM and Microsoft Intune) meet VA’s requirements for the DEX enhancement effort, a key component of the VA Chief Information Officer’s Digital Transformation effort that seeks to deliver a “Delightful Employee Experience” to all EUO customers. While a “Delightful Employee Experience” refers to a positive emotional affect when interacting with technology, it is relevant to the feature set and capability of a DEX tool. In addition to helping meet basic prerequisites of a positive experience like reliability, stability, and functionality through software features that improve endpoint performance, DEX tools must also take the overall user’s subjective experience into consideration by offering automated customer satisfaction messaging to help gather, score, and report on the users’ digital experiences.

Additionally, neither solution is capable of “real-time response” - the ability to reach out, interrogate, and affect changes on remote endpoints on or off the VA network, immediately and at scale. This creates a lag time to reach endpoints, which for time-critical tasks like a response to a security incident, is an unacceptable delay and a negative impact to VA security posture. Therefore, 1E Tachyon is the only brand name that can fill this gap with an out-of-the-box integration with SCCM, 1E Nomad, and Service Now, and deliver industry-leading DEX features. 1E Tachyon has the ability to perform at the VA Enterprise scale, thus supporting that the Tachyon software is established and stable as an on-premises solution with a potential for future transition to a Software as a Service (SaaS) model, following FedRamp (Federal Risk and Authorization Management Program) approval. FedRamp is a mandated compliance program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and a requirement for any cloud-only software solution in VA.

Additionally, 1E Tachyon is already in widescale usage on 170,800 endpoints, representing a significant investment in infrastructure design, process design, deployment, and training. Finally, the 1E Agent – parent software containing the Tachyon module – is already active on all 600,000 VA endpoints (tested to support as many as 1.5 million) greatly simplifying implementation. The 1E software Agent installed on all 600,000 VA endpoints is performing functions such as content delivery/bandwidth management (Nomad), OSD support (PXE Anywhere), and some very limited Tachyon functions like guaranteed state and configuration management/automation for SCCM and Nomad software agent health. Purchase of Tachyon licenses/subscriptions will unlock full capabilities on all 600,000 endpoints. Full deployment of 1E Tachyon across the entire VA is estimated to take less than one business week compared to years with any other alternative, as explained below.

Failure to procure the proposed solution that supports all these requirements greatly increases the complexity and level of effort it will take to enhance some of the most mature and critical VA technologies, which will diminish the ability of all VA IT business units to manage endpoints that deliver medical and benefits services to Veterans.

Specifically, VA will lack a standard, full-featured, centralized DEX tool, impacting key parts of the Digital Transformation effort and delaying priorities like the delivery of a “Delightful End-User Experience” and automation leading to significant cost avoidance.

Use of any other software would require the complete replacement the Tachyon products already in use within VA and the restructuring of several high-visibility, high level of effort projects that rely on this technology. This would require compatibility testing of the new solution in a development lab, installation and extensive application and testing in a pre-production environment, a lengthy engineering and security oversight/review process involving multiple VA organizations and project managers, integration testing with Nomad, SCCM and ServiceNow, a production pilot, and production deployment involving multiple project managers and hundreds of technicians from every VA District and Region; training end-users and Level 1-4 support staff. It is estimated that this project would take a minimum of three years to complete, during which time the existing Tachyon Software subscriptions would need to be maintained.

The estimated duplicative cost of having two systems run in tandem would result in additional annual maintenance (including back-end server requirements), labor (including system administration, maintenance of SaaS environments, and numerous established projects and efforts that depend on the Tachyon solution specifically), and licensing that would exceed $6,900,000.00. The approximate cost of replacement of this brand name software with any other product is $1,200,000.00. These estimated costs are based on previous acquisition history. Additionally, Tachyon’s unique ability to provide an out of the box integration with Nomad and SCCM means that use of any other product will require additional configuration and/or changes to VA’s Microsoft SCCM environment causing unknown delays and additional costs that would not be expected to be recouped through competition. Market research suggests that no replacement product is projected to recoup costs over the lifecycle of the system.

Implementing a new, novel software solution within the VA enterprise environment is a lengthy, formal project requiring significant technical resources and an enormous level of effort to manage the many interoperability factors discussed above.

Failure to procure the proposed brand name increases the complexity and level of effort it will take to mature VA’s mission-critical technologies, potentially leading to a degraded ability of VA IT business units to perform endpoint management tasks while reducing their ability to improve end user satisfaction.

6. Efforts to Obtain Competition: Market research was conducted, the details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among resellers of the brand name 1E Tachyon software subscriptions. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D) and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Starting in June of 2022, VA subject matter experts (SMEs) reviewed online industry publications (e.g., Gartner and Forester), interviewed peers in other organizations, attended professional conferences, and conducted extensive analyses to ascertain if similar software could meet VA’s DEX and Endpoint Management requirements. Based on this research, VA chose six of the software titles in this space: Tanium Core, Nexthink, Aternity, ControlUp, MS System Center Configuration Manager, and MS Intune/Azure/Endpoint Analytics. An 83-question survey was completed by each vendor. Questions covered topics including bandwidth consumption (to preserve network connectivity and reduce risk of outages due to excessive traffic), infrastructure (back-end server environment), client (operational details of the software agent installed on endpoints), service model / role-based administration (details related to centralized management of the solution), operations, dashboards and reporting (reports and intelligence), integration with existing VA products, level of effort, and reference customers. Over the course of a year, proof of concept pilots, product demonstrations and feasibility studies were performed by VA’s SMEs based on questionnaire results. These analyses, completed in October of 2023, suggested that no other product could meet the VA technical and business requirements. Nexthink cannot integrate with VA’s content delivery mechanism (Nomad), offers no native intelligent bandwidth management capability, has prohibitively demanding on-premises infrastructure requirements, and is quite far from a FedRAMP certification that would allow a SaaS alternative to on-premises hardware. Nexthink also lacks the level of automation and offline “self-healing” functionality VA needs. Tanium Core lacks integration with Nomad and is more focused on endpoint management and security, lacking many DEX features native to other products. Aternity doesn’t integrate with Nomad and SCCM, cannot broadcast messages, does not have completely offline “self-healing” functionality, requires a large infrastructure, is not FedRamp certified, lacks robust remediation capability, and is primarily focused on application performance monitoring. In addition to lacking many key features, ControlUp is a SaaS-only solution (for DEX features) and is not FedRamp certified, making it unfeasible for VA deployment. Additionally, it does not manage bandwidth, generates excessive traffic, and does not integrate with Nomad or SCCM. Microsoft Intune lacks Nomad integration, bandwidth throttling, does not support server operating systems, and lacks many of the DEX features needed by VA. MS System Center Configuration Manager features are primarily focused on endpoint management, software distribution, reporting, and operating system deployment, lacking most of the DEX features of other tools.

The Government conducted additional market research in February 2024 by using the NASA SEWP V GWAC provider lookup tool to determine what vendors can meet the requirement to provide brand name 1E Tachyon Endpoint License Subscriptions. Based on this market research, the Government found nine (9) Service-Disabled Veteran- Owned Small Business (SDVOSB) resellers that can provide the brand name 1E Tachyon Endpoint License Subscriptions. Therefore, limited competition is expected among SDVOSBs for this proposed action.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Vadim Bransburg Date: ______________________________

Director Endpoint Management Signature: __________________________

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition. Additionally, NASA SEWP V has already determined the prices on contract to be fair and reasonable. Finally, the successful quote will be compared with the Independent Government Cost Estimate.

Kendra M. Casebolt Date: ________________________________

Procuring Contracting Officer Signature: ____________________________

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Kendra M. Casebolt Date: ________________________________

Procuring Contracting Officer Signature: ____________________________

13. Office of General Counsel (OGC) Review: I have reviewed this document and find it legally sufficient, based on the representations set forth in the documents and, if any, attachments. The Head of the Contracting Activity’s approval is an independently supported decision not wholly reliant on the legal sufficiency determination.

Rachel Fromm Date: ________________________________

Office of General Counsel Signature: ____________________________

Approval

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby approve the acquisition of brand name 1E Tachyon Endpoint License Subscriptions on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.

Date: ____________ Signature: __________________________________ Jeffrey C. Neill Head of the Contracting Activity Technology Acquisition Center

Office of Procurement, Acquisition and Logistics