JA.docx

Revised 05/10/2018

SOLE SOURCE JUSTIFICATION FOR SIMPLFIED ACQUISITIONS

FAR Part 13.501(a)(1)(ii)

1. Identification of the agency and the contracting activity:

The Office of Acquisition Management proposes to enter into a contract on the basis of other than full and open competition on behalf of the Department of State (DoS), Bureau of Consular Affairs (CA), Office of Consular Systems & Technology (CST).

2. The nature and/or description of the action being approved.

AQM intends to award a new brand name contract. A Firm-Fixed-Price contract is anticipated.

3. A description of the supplies or services required to meet the Department’s needs.

This procurement request is to co-term the renewal of Nessus Security Center Continuous View (CV) products and Nessus Professional Vulnerability Scanner. The CV products and the Vulnerability Scanner both are needed to provide continuous support for monitoring of the CA enterprise to maintain a secure infrastructure in support of US Visas and Passport systems. CA/CST requires the following:

4. An identification of the statutory authority permitting other than full and open competition:

FAR 16.505(a)(4)(ii) – Name Brand

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the action require use of the authority cited.

The Nessus Professional Vulnerability Scanner is the only security scanner on the IT-CCB approved OpenNet software baseline list. Tenable Nessus Pro automates this manual process by “scanning” systems against pre-defined policies or against unique CA customized policies. In addition, this product fills the iPost gap. iPost can only scan OpenNet-based Windows systems, whereas Tenable Nessus Pro can be used across a large variety of platforms, including DMZ-based systems, and if necessary, be installed and run from a CA laptop to scan stand-alone systems (or systems not connected to either OpenNet or in the DMZ).

CV is used to identify vulnerabilities, reduce risk and ensure compliance through a unique combination of detection, assessment, reporting, and pattern recognition of all network devices. Security Center CV supports more technologies than any other vendor, including operating systems, network devices, hypervisors, databases, tablets, phones, web servers and embedded systems—with 100% identification. CV also integrates with existing network, security, and remediation systems and delivers analytics and security applications via live feed for rapid incident response and remediation; and scales to meet demands of monitoring additional virtualized systems, cloud services, and proliferation of IT devices.

If the Tenable software is not renewed, the process of reviewing/assessing CA systems for vulnerabilities and misconfigurations could be reduced to a manual process, which would greatly increase the length of time a security assessment takes. Also, CA/CST will not be able to monitor the infrastructure to detect network anomalies, connectivity changes, identify BOTNet activity, provide forensic logging analysis capabilities, DNS and mDNS monitoring, web HTTP and SSL monitoring, and continuous view logging analysis across both Windows and Linux platforms.

6. A description of the efforts made to ensure that offers are solicited from as many potential sources as is practicable, include whether a notice was or will be publicized as required by Subpart 5.2 and, if not, which exception under 5.202 applies.

The solicitation along with the brand name justification will be posted through NASA SEWP or FedBid in an attempt to attract as many resellers as possible.

7. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable. Note: dollar amounts may not exceed statutory limitations for the commercial items test program identified in FAR 13.500.

SEWP contract pricing has already been determined fair and reasonable by NASA however a discount will be requested. Additionally, the Contracting Office will determine that the anticipated price(s) will be fair and reasonable based on market research, comparison of previous purchase prices found reasonable, or a comparison with similar items in related industry. By signing the justification the Contracting Officer makes a determination that the cost/price to the Government are expected to be fair and reasonable.

8. A description of the market research conducted (per FAR Part 10) and the results or a statement of the reason market research was not conducted.

Multiple Government Wide Acquisition Vehicles were searched. A search using NASA SEWP’s Market Research tool yielded 74 resellers of Tenable goods and services.

11. A statement of any actions the agency will take to remove or overcome any future barriers to competition before any subsequent acquisition for the supplies or services required.

CST will continue to conduct market research to determine if any other become available that can fulfill the Government’s requirements. The replacement of CA/CST hardware as products approach end-of-use will be competed to the greatest extent practicable. Also, any responses to this justification will be considered for use in future procurements similar to this one.