20120957 Sole Source Justification Synack 7-2-21_Redacted.pdf

OPOAM 3013.501(a)(1)(ii) Sole Source Justification (SSJ)

Test Program for Certain Commercial items for procurements exceeding the Simplified Acquisition Threshold (SAT) pursuant to FAR Subpart 13.5, including Brand Name Template

Sole Source Justification for Simplified Acquisitions under the Test Program for Certain Commercial Items for acquisitions exceeding the SAT including brand name for use when applicable. Rev. 6/2021 SSJ No.: XXX-XX 1

SSJ No.: 20120957

Date: 06/28/2021_______ PR Number: __20120957________

Pursuant to the requirements under the authority of the test program for commercial items at 41 U.S.C. 1901 as implemented by Federal Acquisition Regulation (FAR) 13.501 and consistent with the content requirements of FAR 6.303-2.

1. Agency and Contracting Activity.

The Department of Homeland Security, U.S. Custom and Border Protection (CBP), Office of Information and Technology (OIT), Cyber Security Directorate (CSD) intends to award a sole source contract.

2. Nature and/or description of the action being approved.

CBP intends to award a sole source contract to Synack, Inc, 1600 Seaport Blvd, Suite 170, Redwood, CA 94063 using Commercial Test procedures without seeking competition for services to perform IT networks and systems vulnerability discovery, disclosure, and assessment utilizing crowdsourcing techniques. This action is being taken pursuant to FAR 13.501. The Synack, Inc. is the only company that provides the type of upgrade services required to support the agency needs and ensure a continuation of service.

3. Description of Supplies/Services. Describe the supplies or services to be acquired. Provide the estimated total value (including options, if any).

CBP requires a diverse set of researcher talent to discover unknown weaknesses within CBP systems. Synack is experienced in conducting vulnerability discovery engagements on Cloud Service Providers (Platform-as-a-Service) and is pre-authorized on Microsoft Azure, Amazon Web Services, and Google Cloud Platform at a total cost of $275,000.

Period Unit Price Total 12 months 10 Assessments $27,500 $275,000

4. Identification of the authority. This action is being taken under the authority of the Test

Program for Commercial Items, 41 U.S.C. 1901.

http://uscode.house.gov/

Sole Source Justification for Simplified Acquisitions under the Test Program for Certain Commercial Items for

SSJ No.: XXX-XX 2

5. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

Synack provides services that are unique and highly specialized in that is experienced in conducting vulnerability discovery engagements on Cloud Service Providers (Platform-as-a-Service). Synack is also unique and highly specialized in that it is the only Bug Bounty provider pre-authorized on Microsoft Azure, Amazon Web Services, and Google Cloud Platforms. Pre-Authorized access is necessary in the success and depth of tests within the CBP IT Cloud infrastructure. Furthermore, Synack provides Mission-based scenario driven assessments that emulate real-world cyber attacks allowing CBP to pinpoint and target vulnerabilities being executed by Advanced Persistent Threat actors.

In conclusion, all of this information points to the conclusion that only Synack can perform the contract, so that CBP may restrict competition to the only company capable of performing.

6. Description of efforts made to ensure that offers are solicited from as many potential sources as is practicable.

The SSJ will be publicized on Beta.sam.gov.

7. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable. (Use information such as commercial pricelists or prior acquisition history that will help the Contracting Officer determine the anticipated cost is fair and reasonable or discuss the application of any of the techniques described at FAR 13.106-3(a)(2) and/or 13.106-3 (b)(3)).

The contracting officer determines that the anticipated price(s) will be fair and reasonable based on Rough Order of Magnitude (ROM) pricing obtained from the latest First Source II pricing, along with industry pricing.

8. Description of market research.

Although this is a sole source selection, market research was conducted to ensure there were no other providers. CBP is currently utilizing the services of both HackerOne and Synack for Bug Bounty services. Synack’s added capability of Mission style Red Team services sets Synack apart from other service providers. With the mission-based scenario driven assessment capabilities, CBP is afforded more targeted scoping in vulnerability discovery assessments.

9. Any other facts supporting the justification. (You must explain why technical data packages, specifications, statements of work, or purchase descriptions are not suitable for enhancing

Sole Source Justification for Simplified Acquisitions under the Test Program for Certain Commercial Items for

SSJ No.: XXX-XX 3 competition or not available. Discuss why your requirement cannot be modified to increase competition. If you are contending only one source can meet the Government’s minimum need, you must document the reason why and describe the extent to which the Government will be harmed if not acquired from that vendor. Address any potential duplication of cost, if applicable.)

U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT), Cyber Security Directorate (CSD), Vulnerability Assessment Team (VAT), is responsible for providing what is known as Bug Bounty Services (BBS) to CBP and the Department of Homeland Security (DHS). Bug Bounty will support securing IT systems under the Federal Information Security Modernization Act of 2014 (FISMA). A “bug bounty program” is a program under which an authorized computer security specialist or security researcher is given temporary access to IT systems for the purpose of identifying and reporting vulnerabilities in exchange for payment. Currently, there are only two companies that offer this service. Synack will be obtained to fulfull the requirement in addition to Hackone which has already been acquired by CBP.

10. A listing of the sources, if any that expressed, in writing, an interest in the acquisition.

None

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for supplies or services required. (Include a statement of actions taken or will be taken to increase competition for future acquisitions of the same item/service).

In the future, CBP will continue to collaborate with the Bug Bounty Service industry in search of emergent services that enhance CBP’s ability to perform it’s Bug Bounty program and provide the targeted scenario driven assessments required to be preformed by vendor pre-authorized for vulnerability discovery on industry leading Cloud Service Provider platforms.

CBP will seek vendor demonstrations of capabilities that meet the CBP requirement for Bug Bounty services.

12. DHS intends to post the requirement pursuant to FAR 13.501(a)(1)(iii) and 6.305(a).

Sole Source Justification for Simplified Acquisitions under the Test Program for Certain Commercial Items for

SSJ No.: XXX-XX 4

13. Technical/Requirements Personnel Certification. I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

______________________________________ 07/01/2021___________ Technical Representative/COR Date

14. Contracting Officer Certification and Approval*

Contracting Officer: Not exceeding $750K Date

*Note: In accordance with FAR 13.501(a)(2)(i), for contracts exceeding the SAT but not exceeding $750,000, the contracting officer’s certification that the justification is accurate and complete to the best of the ordering activity contracting officer’s knowledge and belief will serve as approval.