BNJ_-_redacted.pdf

Solicitation/Brand Name Justification Department of Education - Federal Student Aid

Verisign SSL Certificate Maintenance and Support

1. Identification of the agency and the contracting activity.

Department of Education, Federal Student Aid (FSA) Acquisitions. This document is a Solicitation/Brand Name Justification (BNJ) prepared in accordance with the criteria stated in FAR Part 13.501(a)(1)(ii) & 6.303-2.

2. Nature and/or description of the action being approved.

Department of Education, Federal Student Aid (FSA) has a continuing need for Symantec’s Verisign Secure Socket Layer (SSL) Certificates (Verisign). SSL is a protocol for encrypting and sending data in a secure manner between two destinations. FSA currently uses SSL certificates within the FSA environment to support the encryption of web based data traffic through an independent certificate authority to protect privacy act data and meet security standards overseeing it.

• Premium Certificates - For all data transmissions on production sites, premium certificates are used which hold a higher caliber assurance with the third party certificate authority than rapid certificates.

• Rapid Certificates - Rapid certificates are only used for development, test, or non-external data transmissions that require a third party certificate authority.

• CodeSigning SSL Certificates - FSA also has a continuing need for CodeSigning SSL certificates which are used to support the FMS (Financial Management System). FMS has had issues in the past with the newer Java version’s default security settings blocking the current Oracle E- Business Suite (EBS) JAR files from being loaded. Oracle’s recommendation to resolve the EBS installation issue was to switch from signing JAR files with a self-signed 1024-bit key certificate to a code signing certificate from a trusted certificate authority.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

FSA requires the following products for the duration of 12/11/2015 to 12/10/2017. All prices are based on an IGCE.

MPKI for Premium SSL Part # MPKI-SSL-PRE Qty: 458; Unit Price: $xxxxx Ext. Price: $xxxxxxx

Rapid SSL Part # RAPID-SSL Qty: 650; Unit Price: $xxxxxxx Ext. Price: $xxxxxxx

CodeSigning SSL Part # CODESIGNING-SSL Qty: 2; Unit Price: $xxxxxx Ext. Price: $ xxxxxx

Platinum Support

- Technical Support 24x7x365 - with no black out times.

- Dedicated Technical Account Manager

- Monthly Support Reviews – highlights adjustments, news, etc.

- Unlimited Admin IDs & Domain Names – No Charge

- Priority in Technical Email Questions Part # PLATINUM-SUPPORT Qty: 1; Unit Price: $ xxxxxx

Est. total contract value: $ xxxxxx

4. An identification of the statutory authority permitting other than full and open competition.

EDAR 3413.0003(c)(1)(iii) FSA – Simplified Acquisition Procedures. 20 U.S.C. 1018a. - Procurement flexibility.

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

Verisign SSL is a brand name product of Symantec. It is of the utmost importance to FSA that it protects the public’s financial and private data when transacting business via the web. Symantec is the industry standard for certificate trust authorities in the financial industry and other industries dealing with PII. Ninety-seven of the world's 100 largest financial institutions and 75 percent of the 500 biggest e-commerce sites in North America use SSL Certificates from VeriSign.1

6. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart 5.2 and, if not, which exception under 5.202 applies.

Market research was limited to authorized resellers of Verisign SSL. Symantec markets the products on the open market directly and also through authorized resellers. This

1 http://www.symantec.com/ssl-certificates-advantages https://acquisition.gov/far/current/html/Subpart%205_2.html#wp1107980 https://acquisition.gov/far/current/html/Subpart%205_2.html#wp1107990 http://www.symantec.com/ssl-certificates-advantages

Solicitation/Brand Name Justification will be publicized on FedBizOpps for a minimum of two (2) days to ensure adequate competition.

7. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

Each offeror’s quote will be evaluated in accordance with 13.106-2. The price reasonableness will be determined through adequate price competition amongst interested offerors and price analysis against the IGCE, which is based on historical prices.

8. A description of the market research conducted and the results or a statement of the reason market research was not conducted.

While other SSL options do exist, other products such as Go Daddy and Digicert do not provide the same level of trust and support. See paragraph 5 and 9 for additional details.

9. Any other facts supporting the use of other than full and open competition.

Symantec provides Managed PKI for SSL Control Center through which FSA issues and manages certificates, Premium 24/7/365 Tier 1 maintenance and support at Gold maintenance prices, and Certificate Intelligence Center which allows for search and validation of SSL certificates within FSA’s network environment, reducing the man-hours required for SSL renewals. Symantec is also able to provide a wide variety of SSL products which will allow FSA to purchase MPKI Premium SSL, Rapid SSL, and CodeSigning SSL certificates from one vendor.

Symantec’s products reduce the possibility of site disruptions and security risks. The cost savings of relying on a less trusted certificate authority is not worth the potential risk and cost of a data breach due to SSL compromise. The Symantec product has been deployed and standardized throughout the FSA environment. Therefore, replacing the product can introduce unwarranted risks and can cost the Government a significant increase due to testing, integration, and implementation of the new software.

10. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

This information is redacted.

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

For the foreseeable future, FSA intends to use the Symantec’s Verisign SSL Certificates.

Should this subsequently change, a future opportunity may arise to consider other alternate tools for FSA privileged account management.

12. Certification.

This justification is accurate and complete to the best of my knowledge and belief. The requiring FSA program office has provided written supporting data, which is contained in the contract file, that verifies the technical requirements and support the government ongoing need to use the aforementioned brand name commercial items.

__Signed copy in file_______________ __12/8/15__________ Andrew Jernell Date Contracting Officer Federal Student Aid US Department of Education