JnA Redacted

DB Protect Software and Maintenance

Control Number VA-26-00089068

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity:

Department of Veterans Affairs (VA)
Office of Procurement, Acquisition, and Logistics
Technology Acquisition Center

23 Christopher Way

Eatontown, New Jersey 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order (DO) issued under National Aeronautics and Space Administration (NASA) Solution for Enterprise-Wide Procurement (SEWP) V Government wide Acquisition Contract (GWAC) contract NNG15SD20B with Cynergy Professional Systems LLC (Cynergy) to provide brand name TrustWave Holdings Inc. (TrustWave) DbProtect term software licenses with maintenance and technical support. 3. Description of Supplies or Services: The VA Office of Information and Technology (OIT) Cyber Security Operations Center (CSOC) has a requirement for renewal of 11,000 brand name TrustWave DbProtect Database Vulnerability Scanning term software licenses with maintenance and technical support. In August the Government released solicitation 36C10B26Q0452 on the NASA SEWP V website; however, due to new information received at that time, the solicitation was subsequently cancelled, and VA is working a separate competitive solicitation. Therefore, the CSOC requires continuation of the current solution until the new competitive action can be awarded. The VA currently implements TrustWave DbProtect software as the backbone infrastructure of VA’s database vulnerability scanning platform. The Federal Information Security Management Act (FISMA) of 2002, National Institute of Standards and Technology (NIST) 800-53 (CA-1, CA-2, and RA-5), VA Directive 6500, VA Handbook 6500, VA Handbook 6517, and Office of Information Security (OIS) Assessment and Authorization Standard Operating Procedures mandate that the VA audit database security across the VA Enterprise. VA currently uses TrustWave DbProtect infrastructure to provide real-time Enterprise database vulnerability scanning across all VA database management systems. The DbProtect infrastructure acts as a console with an enterprise database vulnerability scanning view and provides centralized report management; enterprise scalability for multiple users; a centralized repository; load balancing; credentialed management; and centralized scan and user role-based access management. The OIT CSOC also requires software maintenance to provide vulnerability updates, monthly updates to