BNJ_-_redacted.pdf

Solicitation/Brand Name Justification Department of Education - Federal Student Aid AppDetective Software License and Maintenance

1. Identification of the agency and the contracting activity.

Department of Education, Federal Student Aid (FSA) Acquisitions. This document is a Solicitation/Brand Name Justification (BNJ) prepared in accordance with the criteria stated in FAR Part 13.501(a)(1)(ii) & 6.303-2.

2. Nature and/or description of the action being approved.

U.S Department of Education, Office of Federal Student Aid (FSA), has a continued need to purchase subscription licenses and software maintenances for Trustwave Holdings, Inc.’s (Trustwave) AppDetectivePro and DbProtect products to provide FSA with database security.

DbProtect is a data security platform used by the Debt Management Consolidation System (DMCS) to uncover database configuration mistakes, identification and access control issues, missing patches, or any toxic combination of settings that could lead to escalation of network intrusions that lead to network access, data leakage, denial-of-service, or unauthorized modification of data held within data stores.

DMCS was a Xerox operated system and DbProtect licenses and annual maintenance was purchased by Xerox. DMCS is now run by a new operator, MAXIMUS Federal Services, Inc.

(Maximus), and most Xerox licenses were transferred to FSA to provide to Maximus (or any third-party contractor) to run DMCS. Six (6) licenses of DbProtect were transferred to FSA with maintenance in effect until September 11, 2015. Since FSA now owns the licenses, it is the Government’s responsibility to renew maintenance.

AppDetectivePro allows usage on all database platforms EXCEPT mainframes.

AppDetectivePRO is a database and Big Data scanner that can immediately uncover configuration mistakes, identification and access control issues, missing patches, or any toxic combination of settings that could lead to escalation of privileges attacks, data leakage, denial-of-service, or unauthorized modification of data held within data stores. It provides the ability to immediately discover, assess, and report on the security, risk, or compliance posture of any database or Big Data store within FSA’s environment. This software is needed to help FSA meet Federal Information Security Modernization Act (FISMA) requirements for proactive risk reduction and continuous system monitoring for the Federal Government Corporate Audit. It performs relational database security testing and assessment for database applications to support broad security assessment coverage and reports database application security scanning results for FISMA compliance considerations.

AppDetectivePro for Vulnerability Assessment for IBM DB2 on OS/390 or z/OS (AppDetective VA) allows Vulnerability Assessment for mainframe database platforms. It performs relational database security testing and assessment for database applications to support broad security assessment coverage and reports database application security scanning results for FISMA compliance considerations.

Without continued renewal of the Trustwave products, the FSA databases would be insecure and could be easily exploited and compromised for personal privacy information (PII). All systems could be placed at a high level of security risks. FSA would also fail FISMA, A-123 and C & A audits, as we would no longer be in compliance with NIST SP 800-53, and the continuous monitoring requirement.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

DbProtect Standard Support for DMCS Manufacturer SKU: DBP-STD-MAINT Licenses Type: Server Quantity: 6 Period of Performance: 3/1/16 - 3/31/17

AppDetective Professional Manufacturer SKU: ADP-CAL-UNL Licenses Type: Named User Quantity: 1 Period of Performance: 2/10/16 - 3/31/17

AppDetectivePro - Vulnerability Assessment for IBM DB2 on OS/390 or z/OS Manufacturer SKU: ADP-Z-VA-GOV Licenses Type: Instances Quantity: 6 Period of Performance: 2/12/16 - 3/31/17

Estimated Price: $XXXXXXXX

Two (2) optional years are also requested:

Option Year 1 Period of Performance: 4/1/17 - 3/31/18

Option Year 2 Period of Performance: 4/1/18 - 3/31/19

Total estimated value of the contract including all optional years: $XXXXXXXXX

4. An identification of the statutory authority permitting other than full and open competition.

EDAR 3413.0003(c)(1)(iii) FSA – Simplified Acquisition Procedures. 20 U.S.C. 1018a. - Procurement flexibility.

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

AppDetectivePro, AppDetectivePro VA, and DbProtect are commercial brand name products of Trustwave.

6. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart 5.2 and, if not, which exception under 5.202 applies.

Trustwave markets their products through various resellers in the open market. This Solicitation/Brand Name Justification will be publicized on FedBizOpps for a minimum of two (2) days to ensure adequate competition.

7. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

Each offeror’s quote will be evaluated in accordance with 13.106-2. The price reasonableness will be determined through adequate price competition amongst interested offerors and price analysis against the IGCE and historical prices.

8. A description of the market research conducted and the results or a statement of the reason market research was not conducted.

Trustwave was contacted to determine how it markets this license, support and maintenance. Based on that feedback, no further market research was conducted.

https://acquisition.gov/far/current/html/Subpart%205_2.html%23wp1107980 https://acquisition.gov/far/current/html/Subpart%205_2.html%23wp1107990

9. Any other facts supporting the use of other than full and open competition.

Without continued renewal of the Trustwave products, the FSA databases would be insecure and could be easily exploited and compromised for personal privacy information (PII). All systems could be placed at a high level of security risks. FSA would also fail FISMA, A-123 and C & A audits, as we would no longer be in compliance with NIST SP 800-53, and the continuous monitoring requirement. In addition, DbProtect was purchased as part of an audit finding. Without the renewal of this license DMCS would not be able to pass the security audits that are performed on a yearly basis.

If FSA were to compete for other security products it could introduce unnecessary risk to the FSA environment with potential issues during installation and deployment. In addition, replacing the products may not be financially prudent as the cost to purchase the new software with maintenance, possibly replace the hardware, and train the employees on the use of new products may outweigh the benefits of replacing the software.

10. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

This information is redacted.

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

For the foreseeable future, FSA intends to use the Trustwave’s database security products.

Should this subsequently change, a future opportunity may arise to consider other alternate tools for FSA privileged account management.

12. Certification.

This justification is accurate and complete to the best of my knowledge and belief. The requiring FSA program office has provided written supporting data, which is contained in the contract file, that verifies the technical requirements and support the government ongoing need to use the aforementioned brand name commercial items.

Andrew Jernell Date Contracting Officer US Department of Education Federal Student Aid