JA - IO Security Management Imperva - redacted.pdf

X6530 Web Application Firewall Appliance Control Number: VA-25-00052625 and Protection Support

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for the purchase of a Brand Name Imperva Web Application Firewall (WAF), equipped with hardware and software components and client reputation services for 6500 series, subscription and maintenance services.

3. Description of Supplies or Services: VA requires system security monitoring of all system logs and network connectivity to provide event and log correlation, event alerting and information security threat intelligence, and reporting of all web application activity, which use a web application firewall for data center systems and networks. Using combined Security Information and Event Management (SIEM) WAF plug-in data feeds for Imperva and the existing Imperva architecture, collectively referred to as brand name Imperva WAF appliances and software, will meet all of these requirementsThe Web Application Firewall software includes standard software licenses. This procurement also includes the necessary license upgrades as identified in the 6500 annual select support model to obtain critical patches, updates for increased product protection, and improvements to the functionality of the product. Additionally, VA requires subscription/maintenance to begin once the new Imperva WAF appliance and license are accepted to upgrade the existing Imperva. The required subscription and maintenance includes 24/7 telephone and email support, software updates, patches and defect support for one year. The Imperva WAF appliances will be delivered within 30 days after award. The maintenance period shall be 12-months from VA’s acceptance of the Imperva WAF appliances, cards and reputation services. The total estimated value of the proposed action for base year is $, inclusive of options.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the spell out supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: AITC Security Monitoring Center centrally manages IT security operations of all IO data centers, and likewise all of the IO data centers must be able to use the same centralized Security Monitoring Center console. VA requires a WAF appliance that is compatible with the existing infrastructure, protocols, and functionality to ensure continued operation of the IO data centers. For these reasons, the new WAF appliances that VA acquires must match the existing WAF and SIEM architecture currently in use at the IO data centers and the Imperva WAF appliance is the only brand name WAF appliance that can be used with this existing data center architecture.

Introducing any other brand name appliances to this architecture would require extensive redevelopment efforts to expand the current WAF and SIEM architecture.

Replacement of the aforementioned IO infrastructure cost would be an estimated $ in equipment and training costs and would require multiple years to transition to the new platform, based on the original implementation project to standardize security infrastructure across data centers.

In addition, Market research, as provided in Section 8 of this justification, demonstrates a scarcity of competition among resellers capable of providing the requisite Imperva subscription maintenance and support services. This restrictive competitive environment is primarily due to the fact that certified resellers, often in direct alignment with Imperva, possess exclusive access to the distinctive software codebase, communication protocols, and hardware application interfaces pertinent to the Imperva WAF. Ensuring the uninterrupted flow of critical support, essential updates, and seamless integration with our existing infrastructure operations requires engagement with these accredited entities who possess the requisite specialized expertise and privileged access to Imperva’s unique technological framework.

Due to the proprietary nature of the current Imperva implementation at FSC, including specific configurations, integrations with other Imperva WAFs across the information technology centers to include the organizations SIEM, and the established operational expertise of the VA staff managing this particular Imperva environment, migrating to a different vendor’s product would entail significant and unjustifiable costs and risks to include: extensive re-engineering and reconfiguration, integration challenges, loss of institutional knowledge and increased risk of disruption.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among resellers for brand name Imperva products and services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized and justification will be made publicly available on the Contract Opportunities website within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Imperva provides commercially available off-the-shelf appliances, licenses, hardware support and hardware maintenance packages that are currently in use in VA. When conducting market research from October 2024 to January 2025, the Government’s technical experts reviewed similar hardware and hardware maintenance support products including F5, PaloAlto and Trustwave to ascertain if these items could meet VA’s requirements. Although other vendors possess similar capabilities to provide the required hardware and maintenance support, only Imperva or an authorized reseller has access to the proprietary source code, existing proprietary protocols, and hardware application programming interfaces specific to the support and maintenance required for the particular appliances. As a result of the market research the technical experts confirmed the support and maintenance required can only be procured through Imperva or an authorized reseller. No other firm has the capability of providing the support or maintenance coverage for the Imperva appliances necessary to support existing IO requirements. Additionally, none of the other products could meet VA’s interoperability and compatibility requirements as detailed in Section 5 of this justification. As of result of the market research, the technical experts confirmed that Imperva Brand Name Web Application Firewall is the only appliance that can meet the requirement and utilize the already existing infrastructure, without requiring the end user facility to develop, test, and implement a new system.

9. Other Facts: None

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date:

Project Manager Signature:

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable. Prices contained in contracts awarded on NASA SEWP IV GWAC have already been determined to be fair and reasonable. As there are multiple vendors on NASA SEWP IV GWAC, additional price competition is anticipated. Finally, the successful quotation will be compared to the Independent Government Cost Estimate.

Procuring Contracting Officer Signature:

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. This contract action exceeds the simplified acquisition threshold, but does not exceed $750,000, therefore, the certification required by FAR 16.505(b)(2)(ii)(A) serves as the Contracting Officer’s approval.”

Procuring Contracting Officer Signature: