TAC-18-49279 SafeNet Equipment Upgrade for Rights Management Software (RMS)

SafeNet Luna 5 Hardware Security Modules

Control Number TAC-18-49279







JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY



Contracting Activity: Department of Veterans Affairs (VA)

Office of Acquisition Operations Technology Acquisition Center 23 Christopher Way

Eatontown, NJ 07724





Description of Action: The proposed action is for a firm-fixed-price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government Wide Acquisition Contract (GWAC) for SafeNet Luna 5 Hardware Security Modules with installation services and maintenance support.



Description of the Supplies or Services: VA Office of Information Technology (Ol&T), Messaging and Authentication Engineering (MAE), Corporate Messaging, requires existing VA-owned SafeNet Luna 4 Hardware Security Modules (HSM) to be upgraded to SafeNet Luna 5 HSMs at the Hines VA facility. The HSMs are network­ attached hardware security appliances which provide cryptographic acceleration, hardware key management, and multiple configuration profiles for VA's Rights Management Software. The current SafeNet Luna 4 HSMs are reaching end of life and need to be upgraded which consists of both hardware and software components. The

upgrades shall include professional services to configure and install the SafeNet Luna 5 HSMs at the Hines VA facility, as well as migration of Public Key Infrastructure (PKI) keys/certificates from the existing HSMs to the new HSMs. PKI keys/certificates are required for VA users to encrypt and access encrypted data, confidentiality, non­ repudiation, authorization, and authentication, and data integrity. The Contractor shall also provide maintenance support of the new modules which shall include 24 hours a day x 7 days a week x 365 days per year support with one hour telephone and/or email response time. The hardware maintenance shall include major releases, point releases, and service releases of applicable hardware updates. All delivery and professional services shall be completed within 30 days. The period of performance for the maintenance shall be 12 months commencing upon Government acceptance of the completed installation and configuration. Four 12 month option periods will be included for continued maintenance. The total estimated price of the proposed action including options is -



Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) Subpart 16.505(b)(2)(i)(B), entitled "Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized."





Rationale Supporting Use of Authority Cited Above: Based on extensive market research, as described in section 8 of this document, it was determined that limited competition is viable among authorized resellers SafeNet products and services.













2 of 4







Upgrading the HSMs requires a migration of the existing encryption key material from the existing HSMs to the new HSMs. The existing PKI Keys/certificates cannot be migrated from a SafeNet HSM to another manufacturer's HSM due to the proprietary nature of the SafeNet HSMs. As such, use of another manufacturer's HSM would result in a duplicative effort as VA would be required to maintain the existing end of life HSMs to provide the storage, security and encryption for existing PKI keys/certificates while simultaneously maintaining the new HSMs for any new PKI keys/certificates. This would result in the need to maintain two certificate issuance platforms simultaneously up until the last certificate on the existing SafeNet platform expires which would be at least two years out. VA would not be able to see efficient operations while maintaining dual platforms, and this duplicative effort will result in duplicative costs and resources which cannot be recouped through competition. Furthermore, continuing the use of the end of life SafeNet equipment for the next two years introduces risk of the operational integrity of the HSM which could result in service outages that would adversely affect VA operations. Specifically, in the event of an outage, VA users would not be able to read encrypted emails with personal identification information (Pll) which may adversely impact patient care.



Additionally, VA requires professional services to include installation and migration, as well as maintenance support to include major releases, point releases, service releases of applicable hardware updates and. Only SafeNet or an authorized reseller can provide the necessary installation services and maintenance support because of the propriety nature of the technology. Assess to SafeNet's proprietary source code is

required to install, configure, migrate, troubleshoot, diagnose and maintain the modules. No other manufacturers have access to the source code required to provide these services.



Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. It was determined however that limited competition is viable among authorized resellers for this brand name item. In

accordance with FAR 5.301 and 16.505(b)(2), the award notice for this action will be synopsized on the Federal Business Opportunities Page (FBO) within 14 days of award. In addition, the Justification for an Exception to Fair Opportunity shall be posted to NASA SEWP V GWAC website at time the solicitation is posted.



Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed.



Market Research: The Government's technical experts conducted market research in January 2018 to ascertain the ability of any other source besides SafeNet or an authorized reseller to provide the aforementioned HSMs and support services. Market research consisted of internet research and direct communication with other HSM manufactures such as DocuSign, Inc. and Thales Group. The market research confirmed that no other HSM manufacture can migrate the keys from SafeNet's HSM to its own HSM due to the need to access the source code and other proprietary data of the SafeNet HSM. Further, no other manufacturer can







provide the required professional services and maintenance support due to the proprietary nature of the SafeNet HSM.



Additional market research was conducted during January 2018 by utilizing the NASA SEWP V GWAC Market Research Request. A total of five contract holders

offering SafeNet brand name products responded: four Service-Disabled Veteran­ Owned Small Businesses (SDVOSB) Group B(2) and one Small Minority Owned Business Group C. Therefore, limited competition exists on the NASA SEWP V GWAC amongst Group B(2) SDVOSB cancer that are resellers of SafeNet products and services.



Other Facts: Not applicable.





4 of 4



SafeNet Hardware Security Modules Upgrade for Rights Management Software (RMS)

Control Number TAC-18-49279





Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.







Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based upon competition among NASA SEWP V GWAC holders who are authorized resellers of the required brand name Philips hardware and software. Contracts awarded on NASA SEWP V GWAC include catalog prices that have already been determined to be fair

and reasonable. Additionally, price analysis shall be conducted by comparing quotes to the Independent Government Cost Estimate.







Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed $700,000, the certification below required by FAR 16.505(b)(2)(ii)(C)(1) serves as approval.